Valve · Report #972243
Add apps to packages 0, 61, 62 with /store/ajaxpackagemerge
Validstatus
highseverity
12upvotes
9 Sept 2020disclosed
Summary
The ajaxpackagemerge API incorrectly allowed partners to add their own apps to certain Valve administrative packages. This can be further leveraged to generate CD key ranges for these administrative packages.
The API access control was corrected.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.