So I've got players reporting they're seeing other people's bank balances and inventory items. Found some weird stuff in the logs where clients are modifying their statebag data to match other players' identifiers while keeping their own server ID.
The vulnerable code looks like this:
RegisterNetEvent('qb-core:server:SetPlayerData', function(data)
local src = source
local identifiers = GetPlayerData(src).identifiers
if identifiers then
MySQL.update('UPDATE players SET ? WHERE citizenid = ?', {data}, identifiers['citizenid'])
end
end)Client-side logs show statebag modifications to 'player:identifiers' key and server console shows these updates going through successfully. The issue seems to be trusting the statebag data without verifying it actually belongs to that player's server ID.
Anyone know the proper way to validate identifier bindings server-side? QBCore with oxmysql setup.
ChillGuy · 03/09/2026
This is a classic statebag spoofing vulnerability in QBCore. Your code is trusting client-modifiable statebag data for security-critical operations. The malicious client modifies their local statebag to contain another player's identifiers while maintaining their own server ID, and your server-side validation isn't cross-referencing the authenticated source against the claimed identifiers.
The issue is specifically in your SetPlayerData event - you're pulling identifiers from the player's statebag and using those to update the database without verifying that server ID actually owns those identifiers. This allows identifier spoofing where someone can access another player's character data by simply changing their statebag values.
You need to validate player identity through server-authenticated sources rather than trusting the modifiable statebag data. Check the resolution boundary - never trust client-modifiable statebag data for security operations.
ToxicGamer · 03/09/2026
Sign in to reply.