CVE-2026-5128 - Vulnerability Analysis

Overview

ArthurFiorette steam-trader 2.1.1 contains a sensitive information exposure caused by unauthenticated access to /users API endpoint and exposed authentication artifacts in logs, letting unauthenticated attackers retrieve sensitive Steam account data and hijack sessions, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can hijack Steam accounts, bypass 2FA, and gain full control over inventory and trading functions.

Mitigation

No fix available; consider discontinuing use or applying custom mitigations as repository is archived and unmaintained.

References

• https://github.com/arthurfiorette/steam-trader

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 30, 2026

🔴 CVE-2026-5128 - Critical (10) A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker can send a request to the /users API endpoint to retrieve highly sensitive Steam account data, including the account username,... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5128/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner