Bulletin ID	MET-2026-005
Date (published)	2026-11-05T00:00:00.000Z
Date (last updated)	2026-11-05T00:00:00.000Z
Severity	High

Description

Starting with Metaplay SDK release 37, the SDK accepts Apple App Store purchases in the StoreKit 2 form. The server-side validation code is overly loose, causing certain forms of illegitimate receipts to be accepted.

Affected Products/Services

The vulnerability affects the Metaplay game server component. Metaplay SDK versions 37.0, 37.1, and 38.0 are affected. The bug is fixed in patch releases 37.2, 38.1, as well as major version 39 and above.

Versions 36.x and below are not affected, as they do not process StoreKit 2 purchases.

Your production environment is vulnerable if it is running one of the affected SDK versions and has Apple in-app products configured (i.e. if your InAppProducts game config has an AppleId column with any non-empty cells).

Impact

The bug could be exploited by cheaters to make fake purchases and receive in-app resources without paying money.

An exploit requires a cheater using a modified or custom game client. The cheater also needs a valid certificate rooted at one of Apple's root certificates. The buggy validation accepts any such Apple-signed certificate, which can be acquired by anyone with an Apple developer account; the fix is to require it to be a specific kind of certificate meant for purchase signing, which is not granted to developers.

To assess whether the bug has been exploited, purchases need to be retrieved from the InAppPurchases table in the production database (all of the shards, in case multiple exist). Scan all persisted purchases with CreatedAt in the time range when the vulnerable server was running. Re-validate the purchases' receipts with an ad-hoc script using the fixed validation code from the SDK. Receipts that do not pass the fixed validation are illegitimate. Contact us at security@metaplay.io if you need help in assessing this.

Solution

Update your production game server to use a fixed version of the Metaplay SDK:

• Vulnerable version 37.0 or 37.1 -> update to Release 37.2.
• Vulnerable version 38.0 -> update to Release 38.1.
• Other version -> no action needed.

Contact Information

Security-related questions or concerns can be sent to security@metaplay.io.

Revision History

Date	Description
2026-11-05	Security Bulletin released