CVE-2026-28428: Talishar

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic allows any unauthenticated attacker to perform authenticated game actions — including sending chat messages and submitting game inputs — by supplying an empty authKey parameter (authKey=). The server-side validation uses a loose comparison that accepts an empty string as a valid credential, while correctly rejecting non-empty but incorrect keys. This asymmetry means the authentication mechanism can be completely bypassed without knowing any valid token. This issue has been patched in commit a9c218e.

Affected products

• Talishar Talishar: before 2026-02-22 (fixed in 2026-02-22)

Published 2026-03-06. Last modified 2026-06-17.