OpenSave versions before 2.4.0‑beta.1 allow an attacker to impersonate paired devices by spoofing the "From" field of RelayMessages in WAN relay requests. Because the software does not verify the sender identity, an adversary who learns a room code can join the room as an unpaired member, read the identifiers broadcast by the legitimate peers, and then craft forged requests to protected synchronization routes. These routes include operations that modify, read, or delete shared data such as saved files or snapshots, potentially allowing unauthorized data compromise or loss.

The vulnerability affects the Liquid‑co OpenSave application prior to version 2.4.0‑beta.1. Any deployment of this software that participates in WAN relay based synchronization and exposes sync endpoints is susceptible. The issue is limited to the OpenSave code base referenced by the CNA vendor list; no other vendors are affected.

With a CVSS score of 6.3, the vulnerability is classified as moderately severe. No EPSS score is currently available, indicating limited data on exploitation likelihood, and it is not listed in the CISA KEV catalog. Attackers need knowledge of the room code and the ability to join the room via the WAN relay, which typically requires presence on the same network or a route to the relay service. The vulnerability is thus exploitable in environments where the room code is exposed or weakly protected, and can lead to unauthorized access to shared data.