Credential Leak Vulnerability in GDevelop Desktop App

CVE-2026-112303

What is CVE-2026-112303?

The GDevelop desktop application, prior to version 5.6.284, is susceptible to a credential leak vulnerability that allows malicious actors to exploit the gd_resource cookie. By incorporating attacker-controlled resource URLs within project files, an attacker can lure victims into opening a specially crafted project. This action triggers the downloadLocalFile() function, which results in the transmission of sensitive credential data to the attacker's server, potentially exposing private cloud project resources.

References