How severe is CVE-2026-28428?

CVE-2026-28428 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2026-28428 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-28428?

CVE-2026-28428 affects Talishar. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-28428?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-28428 have an EU (EUVD) identifier?

Yes. CVE-2026-28428 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9981.

When was CVE-2026-28428 published?

CVE-2026-28428 was published on 2026-03-06 and last updated on 2026-06-17.

CVE-2026-28428

CVE-2026-28428 is a medium-severity vulnerability in Talishar with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-9981
Weakness: CWE-287
Affected product: Talishar
Published: 2026-03-06
Last modified: 2026-06-17

Description

Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic allows any unauthenticated attacker to perform authenticated game actions — including sending chat messages and submitting game inputs — by supplying an empty authKey parameter (authKey=). The server-side validation uses a loose comparison that accepts an empty string as a valid credential, while correctly rejecting non-empty but incorrect keys. This asymmetry means the authentication mechanism can be completely bypassed without knowing any valid token. This issue has been patched in commit a9c218e.

Frequently asked questions

What is CVE-2026-28428?: Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic allows any unauthenticated attacker to perform authenticated game actions — including sending chat messages and submitting game inputs — by supplying an empty authKey parameter (authKey=). The server-side validation uses a loose comparison that accepts an empty string as a valid credential, while correctly rejecting non-empty but incorrect keys. This asymmetry means the authentication mechanism can be completely bypassed without knowing any valid token. This issue has been patched in commit a9c218e.
How severe is CVE-2026-28428?: CVE-2026-28428 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-28428 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-28428?: CVE-2026-28428 affects Talishar. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-28428?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-28428 have an EU (EUVD) identifier?: Yes. CVE-2026-28428 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9981.
When was CVE-2026-28428 published?: CVE-2026-28428 was published on 2026-03-06 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:talishar:talishar:*:*:*:*:*:*:*:*

More vulnerabilities in Talishar

CVE-2026-28429 — High (CVSS 7.5): Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified…
CVE-2026-27632 — Low (CVSS 2.6): Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar…

All CVEs affecting Talishar →

Other CWE-287 (Improper Authentication) vulnerabilities

CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…

Browse all CWE-287 (Improper Authentication) vulnerabilities →