The credential leak vulnerability in GDevelop desktop applications up to version 5.6.284 allows attackers to obtain the gd_resource cookie by embedding attacker-controlled resource URLs in project files. When a victim opens the crafted project, the LocalFileDownloader function sends the cookie to the attacker’ s server, exposing private cloud project resources and compromising confidentiality. This weakness corresponds to improper handling of authentication credentials (CWE-522).

All users of the GDevelop desktop application version 5.6.284 or earlier are affected. The vulnerability is present in the LocalFileDownloader component and the LocalFileResourceMover module, as demonstrated in the 5.6.284 codebase. It cannot be mitigated by users of newer releases that have addressed the issue. The CNA vendor/product list includes GDevelop GDevelop, with affected versions through 5.6.284.

The CVSS score of 5.3 indicates a moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious project file and convince a user to open it, which is a social-engineering scenario. Once the project is opened, the application automatically downloads the external resource, causing the cookie to be transmitted to the attacker’ s server without user consent. Because the attack vector involves user interaction and the exposed credential is used for accessing private cloud resources, the overall risk to individual systems is moderate, but it can lead to significant data exposure if the cookie is reused.