CVE-2026-5128 - Vulnerability Analysis

Overview

ArthurFiorette steam-trader 2.1.1 contains a sensitive information exposure caused by unauthenticated access to /users API endpoint and exposed authentication artifacts in logs, letting unauthenticated attackers retrieve sensitive Steam account data and hijack sessions, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can hijack Steam accounts, bypass 2FA, and gain full control over inventory and trading functions.

Mitigation

No fix available; consider discontinuing use or applying custom mitigations as repository is archived and unmaintained.

References

• https://github.com/arthurfiorette/steam-trader

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner