Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker can send a request to the /users API endpoint to retrieve highly sensitive Steam account data, including the account username, password, identity secret, and shared secret. In addition, application logs expose authentication artifacts such as access tokens, refresh tokens, and session identifiers. This information allows an attacker to generate valid Steam Guard (2FA) codes, hijack authenticated sessions, and obtain full control over the affected Steam account, including unauthorized access to inventory and trading functionality. No fix is available because the repository is archived and no longer maintained.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-30 | 4 | Disclosure4 |
| 2026-03-31 | 2 | Disclosure2 |
🔍 Today's Top Vulnerabilities 🔴 CVE-2026-5128 | CVSS 10.0 🔴 CVE-2026-3300 | CVSS 9.8 🔴 CVE-2026-32714 | CVSS 9.8 🔗 http://ctiwatch.cloud/vulnerabilities #CVE #Vulnerability #ThreatIntel
Post summary
The tweet lists three high‑severity CVEs with their CVSS scores and links to a vulnerabilities page, but it provides no PoCs, exploit code, patches, or evidence of active exploitation.
CVE-2026-5128 A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker can send a request to the /users API endpoint to… https://www.cve.org/CVERecord?id=CVE-2026-5128
Post summary
The text announces a sensitive information exposure vulnerability (CVE‑2026‑5128) in ArthurFiorette steam‑trader 2.1.1 that allows unauthenticated requests to the /users API endpoint; no exploit, patch, or PoC details are provided.
Security Advisory: CVE-2026-5128: Steam Trader 2.1.1 Unauthenticated Sensitive Data Exposure https://labs.cosmicbytez.ca/security/cve-2026-5128 #Cybersecurity #InfoSec #CVE #PatchNow
Post summary
The post announces CVE-2026-5128 affecting Steam Trader 2.1.1 and provides a link to an external advisory, with no evidence of PoC, exploit code, active exploitation, or mitigation details.
🔴 CVE-2026-5128 - Critical A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker can send a request to the /users API endpoint to retrieve highly se... https://www.thehackerwire.com/vulnerability/CVE-2026-5128/ https://t.co/KDBjPlPgm1
Post summary
The post announces a critical information disclosure flaw in ArthurFiorette steam-trader 2.1.1, allowing unauthenticated users to retrieve sensitive data through the /users endpoint, with no mention of exploits, patches, or active attacks.
[CVE-2026-5128: CRITICAL] ⚠️ Critical vulnerability in ArthurFiorette steam-trader 2.1.1 allows attackers to access sensitive data like Steam account details, risking account hijacking and unauthorized access....#cve,CVE-2026-5128,#cybersecurity https://cvefind.com/CVE-2026-5128
Post summary
The post alerts about CVE-2026-5128, a critical flaw in ArthurFiorette steam‑trader 2.10.1 that permits access to Steam account information, but offers no evidence of exploitation, PoC, or patches.
🚨 CVE-2026-5128: ArthurFiorette (CVSS: 10.0)... Plaintext Steam credentials + 2FA secrets exposed via unauthenticated `/users` endpoint = instant account takeover with ... https://zerodaysignal.com/vulnerability/CVE-2026-5128 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-5128, indicating that Steam credentials and 2FA secrets are exposed through an unauthenticated `/users` endpoint, enabling instant account takeover, but it provides no patch, PoC, or active‑exploit indication.