CVE-2026-54609

CVE-2026-54609 exposes a UDP relay in QTI Neon 1.0.0 that forwards RECONNECT_REQUEST packets from clients to hosts without any bounding controls — no rate limiting, no proof-of-prior-connection, no session validation. An attacker spoofing a source IP can send minimal packets to the relay, which amplifies them toward the victim host. The relay is performing a stateful connection-management action (reconnection mediation) on behalf of an unauthenticated actor, treating itself as a dumb forwarder when it's actually maintaining connection state. What matters here isn't the amplification factor — it's the trust boundary shift. Relays are internet-facing by design, yet they mediate connection state as if operating in a semi-trusted context. When RECONNECT_REQUEST forwarding was added, no one asked what happens if this traffic is weaponized against the host. That's the real gap: the relay performs an action that should require authentication without any mechanism to enforce it. Check your relay deployment immediately. Identify every packet type the relay forwards beyond core game traffic — RECONNECT_REQUEST, DISCONNECT, HEARTBEAT, or any stateful signaling. For each, ask whether the relay validates connection state before forwarding. If the codebase has a handleReconnectRequest or equivalent handler, verify it has rate limiting or session proof-of-life logic. If it doesn't, you have an active amplification vector. Consider whether the host should treat all relay-originated traffic as untrusted and apply its own rate limits, since the relay's semi-trusted position is precisely what makes it dangerous as an amplification reflector. The deeper pattern: UDP relays that accumulate QoL features over time tend to introduce new amplification surfaces without corresponding threat modeling. This CVE likely isn't an isolated flaw — it's a symptom of a codebase that added connection-recovery logic without mapping the forwarding attack surface. Treat this as a leading indicator to audit other packet types in your relay stack.

Reviewed through automated stages and approved by a human before publication.