CVE-2026-95699 MrSteam iSteamX Improper Isolation or Compartmentalization
Authenticated users can access other users' device data and control devices due to overly permissive AWS MQTT policies, risking privacy breaches and physical safety.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-95699?
CVE-2026-95699 is a high-severity missing authorization vulnerability in MrSteam iSteamX Hub, published on 24 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.
Weakness: CWE-653
Which versions are affected by CVE-2026-95699?
How do I fix CVE-2026-95699?
No fix has been published for CVE-2026-95699 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-95699 being exploited?
There is no known exploitation of CVE-2026-95699 in the wild and no public exploit code.
Sources
Also known as GHSA-pjrx-22r5-wchr.