MrSteam iSteamX Improper Isolation or Compartmentalization
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.
CVE-2026-95699
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-95699
iSteamX application
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
iSteamX Hub
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "MrSteam",
"product": "iSteamX application",
"versions": [
{
"status": "affected",
"version": "v1.3.42 (build 44)"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "MrSteam",
"product": "iSteamX Hub",
"versions": [
{
"status": "affected",
"version": "v4.2.1"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-95699
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #2155 · Revision 1
- Added to Heist Feed
- Publisher date