Security Experts:

Connect with us

Hi, what are you looking for?



Vulnerability Allowed Hackers to Hijack Steam Accounts

A vulnerability in the Steam password recovery feature allowed anyone to hijack accounts in just a few seconds. Valve patched the security hole, but not before numerous accounts were hacked using the method.

A vulnerability in the Steam password recovery feature allowed anyone to hijack accounts in just a few seconds. Valve patched the security hole, but not before numerous accounts were hacked using the method.

When Steam users want to utilize the “retrieve a lost account” feature, they are instructed to provide their account name, and an email containing a recovery code is sent to their email address.

However, hackers discovered that the step where gamers would normally have to enter the recovery code received via email can be bypassed by leaving the text field blank and hitting the “Continue” button. Then, the user performing the password recovery can simply select a new password.

According to Valve, the account recovery process was affected by this bug between July 21 and July 25. During this period, there have been numerous reports of hijacked accounts, including by prominent gamers.

In addition to fixing the vulnerability, Valve has reset the passwords of accounts for which passwords were changed during July 21-25.

“To protect users, we are resetting passwords on accounts that changed passwords during that period using the account recovery wizard,” Valve told users. “You will receive an email with your new password. Once that email is received, it is recommended that you login to your account via the Steam client and set a new password.”

The company has pointed out that users’ actual passwords were not exposed by the bug. Furthermore, the accounts of gamers who had Steam Guard enabled could not be hacked using this technique, Valve said.

A UK-based gamer using the online moniker “Elm Hoe” has published a video demonstrating how the attack worked.

It is not uncommon for Steam gamers to be targeted by cybercrooks. The list of threats includes phishing, scams, malware, and bots.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.