ArthurFiorette Steam-Trader Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in ArthurFiorette Steam-Trader version 2.1.1. An unauthenticated attacker can send a request to the /users API endpoint to access highly sensitive Steam account data, including the account username, password, identity secret, and shared secret. Additionally, application logs reveal authentication artifacts such as access tokens, refresh tokens, and session identifiers. This information enables an attacker to generate valid Steam Guard (2FA) codes, hijack authenticated sessions, and gain full control over the affected Steam account, including unauthorized access to inventory and trading functionality.

Impact

Exploitation of this vulnerability allows an attacker to access sensitive Steam account information, hijack authenticated sessions, and gain full control over the affected Steam account, including unauthorized access to inventory and trading features.