CVE-2026-28428 Details
Description
Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic allows any unauthenticated attacker to perform authenticated game actions — including sending chat messages and submitting game inputs — by supplying an empty authKey parameter (authKey=). The server-side validation uses a loose comparison that accepts an empty string as a valid credential, while correctly rejecting non-empty but incorrect keys. This asymmetry means the authentication mechanism can be completely bypassed without knowing any valid token. This issue has been patched in commit a9c218e.
An authentication bypass vulnerability has been identified in Talishar, a fan-made Flesh and Blood project, prior to commit a9c218e. The issue arises in the game's endpoint validation logic, where the server-side authentication can be bypassed by sending an empty authKey parameter. This vulnerability allows any unauthenticated attacker to perform authenticated game actions, such as sending chat messages and submitting game inputs. The root cause lies in a loose comparison in the validation process, which accepts an empty string as a valid credential while correctly rejecting non-empty but incorrect keys. As a result, the authentication mechanism can be completely circumvented without knowledge of a valid token.
This vulnerability has been patched in commit a9c218e.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| talishar talishar | < 2026-02-22 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |