CVE-2026-103397

Medium

Description

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

SeverityMedium

CVSS5.6

Exploit probability—

ProductOpenSave

PublishedSep 30, 2026

First seenSep 30, 2026

Weakness typeCWE-290CWE-290

How to fix

Update

Liquid-co OpenSave2.4.0-beta.1 or later

Patches

github.com/Liquid-co/OpenSave/commit/2f2612b13233ac123e01a03cb3008c44bacaeae3

Affected products

Product	Affected versions	Fixed in
Liquid-co OpenSave	v < 2.4.0-beta.1	2.4.0-beta.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.