In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins…
Priority MEDIUM 45Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password.
Why it matters now
EPSS 0.01645 76th percentileScored 2026-11-07
Fix Fixed TGServiceInterface (NuGet): 3.2.5.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | TGServiceInterface (NuGet) | 3.2.1.0 to before 3.2.5.0 | 3.2.5.0 | Patch available | GHSA-42r6-p4px-qvv6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- TGServiceInterface (NuGet) Vendor— Affected 3.2.1.0 to before 3.2.5.0 Fixed in 3.2.5.0 Patch available GHSA-42r6-p4px-qvv6
Remediation
- Fix · GHSA-42r6-p4px-qvv6 TGServiceInterface (NuGet) Fixed in 3.2.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-17107
- 2026-10-03 Alias added: GHSA-42r6-p4px-qvv6
References
Advisory 2
Other 7
- https://github.com/tgstation/tgstation-server/security/advisories/GHSA-42r6-p4px-qvv6
- https://github.com/tgstation/tgstation-server/commit/1812a9c6793c8516c138a105ccfb2108164f0eff
- https://github.com/tgstation/tgstation-server/commit/2894ea03d708c7f16bab47ba5020c2ad4c3d5554#diff-0ba090ea7073a3a304dfdbdfc512f733
- https://docs.microsoft.com/en-us/dotnet/api/system.servicemodel.serviceauthenticationmanager.authenticate?view=netframework-4.7.2#System_ServiceModel_ServiceAuthenticationManager_Authenticate_System_Collections_ObjectModel_ReadOnlyCollection_System_IdentityModel_Policy_IAuthorizationPolicy__System_Uri_System_ServiceModel_Channels_Message__
- https://github.com/tgstation/tgstation-server
- https://github.com/tgstation/tgstation-server/blob/tgstation-server-v3.2.5.0/TGS.Interface/TGS.Interface.nuspec
- https://www.nuget.org/packages/TGServiceInterface
More Tgstation-server vulnerabilities
- TI-2024-27844 Path traversal in tgstation-server CVSS 3.1CRITICAL 9.9
- TI-2025-15571 tgstation-server's role authorization incorrectly OR'd with user's enabled status CVSS 3.1HIGH 8.8
- TI-2020-12691 In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download… CVSS 3.1HIGH 7.7
- TI-2023-15963 Insufficiently Protected ChatBot Credentials in tgstation-server CVSS 3.1HIGH 7.7
- TI-2023-16375 Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API CVSS 3.1HIGH 7.5
- TI-2023-17079 Windows user name disclosure in TGstation CVSS 3.1MEDIUM 5.8
Sources
- CVE-2018-17107 · CVE Program
- CVE-2018-17107 · NVD
- FIRST EPSS
- GHSA-42r6-p4px-qvv6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences