Platform Vulnerability Allowing Server-Side Execution and Datastore Modification

Bug Reports Roblox Application and Website Bugs
,
1

A malicious user was able to modify and create a new datastore in my game, Refuse 2 Die. It appears to be some kind of server-side execution vulnerability allowing them to also edit player data, download copies of the game, etc.

Screenshot 2026-07-30 163202
Screenshot 2026-07-30 1632021776Ă—876 63.5 KB

This user did not have developer access at any point in time, nor do I have any clue who they were. I can confirm there is no backdoor or other vulnerability on my end. This appears to be a sitewide issue impacting all games on the platform. Because of the sensitive nature of this exploit, I will be posting all additional information in the private content section.

A private message is associated with this bug report

43 Likes
2

vouch I really don’t like being bombed with 14 pings because my webhooks were able to be stolen from my servercode :frowning:

13 Likes
3

I love you wally I hope you get the help you need in fixing this issue

5 Likes
6

Scary to see something like this happening to this day, good luck with getting it resolved!

10 Likes
8

This is so strange… I’ve never studied exploiters in depth, but I don’t doubt their capabilities either; how long will we have to worry about the security of our games and the integrity of the players?

5 Likes
11

Hey everyone,

We’re aware of the report, actively investigating, and working on resolving as quickly as possible. Appreciate the patience.

16 Likes
12

maybe better practices u store webhooks in scripts than modulescripts

13

I didn’t really design the system but yeah sure.
Though, Roblox should really add RunContext to ModuleScripts so bytecode can’t get replicated if someone manages to get arbitrary server code execution :confused:

and from the videos I’ve seen from the attackers (since they fired all our discord webhooks with their junkmessage & discord invite) they were/are able to supposedly retrieve server-script bytecode then shove it into a decompiler so that wouldn’t matter anyway :sob:

5 Likes
15

Is roblox planning to disclose how this even happened in the first place?

7 Likes
16

This would be a massive topic, have you seen other games being affected by this exploit?

1 Like
17

Yes. Roblox has identified the vulnerability and it appears to be resolved.

5 Likes
19

You’re better off using HttpService Secrets for Webhook URLs/Tokens which do not replicate and are never exposed to any code.

5 Likes
20

I do not think they are compatible with the proxy we use but that would be a nice to use yes, thank you :slight_smile:

Turns out I can’t read lol. Thanks for the headsup :slight_smile:

21

To add, there is still a way of these to get leaked if the allowed domains are unrestricted. If someone really wanted to, assuming they have server access, they could set up a web server that dumps headers, and then send a request from the server with the secret to get logged on their web server.

3 Likes
22

Dudes could have reasonably disclosed this via HackerOne and get paid for their efforts but they decided to choose abusing webhooks and destroying a hibachi game as Primadon from Deepwoken instead

I did not mean to reply by the way, sorry about that

13 Likes
23

When was this video taken? Is this kohua?

24

They could’ve done much worse honestly

25

Roblox should have had an announcement regarding this unless they have absolute certainty on the scope and reached out to affected games and devs.

Not knowing how widespread this was, who was affected, or even using it as an excuse to nudge people to use Secrets is so lame.

7 Likes
26

they could’ve made far more than H1 max payout even through just exploiting ingame economies with 3rd party USD markets. Really unsure what the finders of this vulnerability were thinking given this realistically could’ve net them 6 figures

1 Like
27

Can we get more info on this?
//