Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M

CVE-2026-28428Talishar: Authentication Bypass via Empty authKey Parameter Allows Unauthenticated Game Actions

Medium 5.3

In plain English

A medium-severity improper authentication in Talishar from Talishar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 71.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic allows any unauthenticated attacker to perform authenticated game actions — including sending chat messages and submitting game inputs — by supplying an empty authKey parameter (authKey=). The server-side validation uses a loose comparison that accepts an empty string as a valid credential, while correctly rejecting non-empty but incorrect keys. This asymmetry means the authentication mechanism can be completely bypassed without knowing any valid token. This issue has been patched in commit a9c218e.

Affected products (as reported)

Vendor	Product	Versions
Talishar	Talishar	< a9c218efa37756c9e7eed056fbff6ee03f79aefc

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/Talishar/Talishar/security/advisories/GHSA-2659-p579-wv83 x_refsource_CONFIRM
https://github.com/Talishar/Talishar/commit/a9c218efa37756c9e7eed056fbff6ee03f79aefc x_refsource_MISC