New really bad engine bug?

Help and Feedback Scripting Support
#1

I AM POSTING HERE BECAUSE I CANNOT POST IT ELSEWHERE, IF YOU ARE A MODERATOR PLEASE MOVE IT TO ENGINE BUGS

roblox_username_exploit

how_its_done
how_its_done1670×348 50.5 KB

PLEASE FIX THIS ASAP, THEY CAN DO THINGS SUCH AS HAVE THINGS THEY SHOULDN’T HAVE ACCESS TO (ADMIN CMDS, DEVCONSOLE, ETC).

Discuss below.

#2

PLEASE FIX THIS ASAP, THEY CAN DO THINGS SUCH AS HAVE THINGS THEY SHOULDN’T HAVE ACCESS TO (ADMIN CMDS, DEVCONSOLE, ETC).

The only way they’d have access to admin commands is if you use a username, they have no access to devconsole or the admin commands otherwise as this only spoofs their Name and not UserId

1 Like
#3

We’re using Adonis, they go by Username and UserId unfortunately I think.

#4

You should be able to edit this yourself or use this simple script to completely stop it

local HttpService = game:GetService("HttpService")

game:GetService("Players").PlayerAdded:Connect(function(plr)
	local success, data = pcall(function()
		return HttpService:JSONDecode(HttpService:GetAsync("https://api.rprxy.xyz/users/"..plr.UserId)).Username
	end)
	if plr.Name ~= data then
		plr:Kick("Invalid Name")
	end
end)
1 Like
#5

Roblox is already informed about this.

#6
#7

Engineers are already aware.

Don’t create topics circumventing the post approval process. It’s off-topic for #help-and-feedback:scripting-support.