An authentication bypass flaw in Talishar’s game endpoint validation allows any attacker to carry out actions that normally require authentication, such as sending chat messages or submitting game inputs, simply by providing an empty authKey parameter. The server compares the supplied credential loosely, accepting an empty string as valid while rejecting non‑empty incorrect keys, creating a critical asymmetry in the authentication logic.

This vulnerability affects the Talishar fan‑made Flesh and Blood project. Any deployment of the game server running a version of the code prior to commit a9c218e is vulnerable; newer versions contain the patch.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests low current exploitation probability. The issue is not listed in the CISA KEV catalog. Because the attack requires only the submission of an empty authKey, it can be executed remotely over the public network without prior knowledge of valid credentials, effectively granting unauthenticated users privileged actions within the game.