Read the docs
TI-2022-07680 Aliases CVE-2022-23627

Inadequate access verification when using proxy commands in ArchiSteamFarm

Priority LOW 32CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00992 62nd percentileScored 2026-11-07
Fix Fixed ArchiSteamFarm (JustArchiNET): 5.2.2.5, 5.2.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JustArchiNETArchiSteamFarm5.2.2.2 to before 5.2.2.5; 5.2.3.0 to before 5.2.3.25.2.2.5, 5.2.3.2Patch availableCNA
  • ArchiSteamFarm VendorJustArchiNET Affected 5.2.2.2 to before 5.2.2.5; 5.2.3.0 to before 5.2.3.2 Fixed in 5.2.2.5, 5.2.3.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:archisteamfarm_project:archisteamfarm:*:*:*:*:*:*:*:*5.2.2.2 to before 5.2.2.5; 5.2.3.0 to before 5.2.3.2VulnerableJustArchiNET
  • cpe:2.3:a:archisteamfarm_project:archisteamfarm:*:*:*:*:*:*:*:* Versions 5.2.2.2 to before 5.2.2.5; 5.2.3.0 to before 5.2.3.2 Vulnerable ·JustArchiNET

Remediation

  • Fix · CNA ArchiSteamFarm (JustArchiNET) Fixed in 5.2.2.5, 5.2.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23627

References

  • TI-2021-12460 Accidental removal of IPCPassword (< 5.1.2.4) CVSS 3.1HIGH 7.5
  • TI-2021-12461 Denial of Service via Steam chat in ArchiSteamFarm CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences