Advisory: Unvalidated Server-Controlled URI Passed to ShellExecute in Magic: The Gathering Arena (MTGA) Windows Client

Vulnerability Overview Title: Advisory: Unvalidated server-controlled URI passed to ShellExecute in Magic: The Gathering Arena (Windows client) Researcher: Donald Warren (Independent) Vendor: Wizards of the Coast (Hasbro) Product: Magic: The Gathering Arena (MTGA), Windows desktop client (Steam) Affected Versions: 2026.59.30.12801, 127931.6, and subsequent 2026.60.x builds Category: CWE-20 (Improper Input Validation) CWE: CWE-749 (Exposed Dangerous Method) Status: Reported to vendor on 2026-06-14; No substantive response → CVE ID request handled by MITRE CNA-LR --- Impact Vulnerability Description: The MTGA Windows client renders a "carousel" on its main screen, fetching content from the vendor's backend via TLS. One action type, , carries a URL string that the client passes directly to the Windows shell without validating the URI scheme or target domain. Call Chain: carousel item (server-supplied) → GoToExternalUri action.Arguments (raw string) → UriOpeners.OpenURI(string) → Application.OpenURI(string) (Unity) → ShellExecuteW(...) (Windows) Specific Details: only performs deep linking and parameter rewriting for the special scheme ; it does not enforce scheme whitelists or domain checks. is called, but its result is only logged and never enforced. Any other scheme ( , , , , or any registered URI handler) is forwarded to the operating system. Automatic Trigger: The carousel's method runs automatically when the main screen loads and upon every reconnection to the backend. Therefore, a crafted item can be dispatched without any user interaction. Potential Impact: Any URI scheme handler registered on the victim's Windows system can be invoked silently. Combined with vulnerable Windows URI handlers (e.g., , "Follina"-class issues like CVE-2022-30190), this could lead to code execution. Since the carousel content is delivered server-side to all connected clients, the defect has a supply-chain-style blast radius: a single malicious carousel item (a plain text string in the JSON response, lacking client-side integrity or content validation) will immediately affect every connected client. --- Remediation Enforce Scheme Whitelist: In , allow only or . Add Client-Side Domain Whitelist: Whitelist official vendor domains. Add Server-Side Whitelist: Whitelist values for the action. Consider Removing : Replace with a controlled in-game browser. --- Disclosure Timeline 2026-06-14: Reported to responsibledisclosure@hasbro.com. 2026-06-07: Acknowledged; a separate, unrelated finding coordination completed (channel confirmation monitoring). No Substantive Response: Regarding this finding → CVE ID request handled by MITRE CNA-LR, October 2026. --- Additional Information No secrets, credentials, or live infrastructure addresses: Included in the remediation advice. Testing was limited to the researcher's personal installation; vendor servers, other accounts, and third-party systems were not accessed.

Goal Reached Thanks to every supporter — we hit 100%!

Advisory: Unvalidated Server-Controlled URI Passed to ShellExecute in Magic: The Gathering Arena (MTGA) Windows Client

More from this source