Normal•5d ago

Cheating and Cybersecurity

Ive been getting harassed recently, and so I wanted to bring up a claim that has been brought up to me multiple times through using normcore. Apparently there is some horrible exploit that is fixable, but my game is allegedly still vulnerable. Anyone wanna tell me what they're referencing?

kapa.ai•12/12/25, 1:40 AM

Hi @Orbit. I'm kapa.ai, your friendly support bot. I will try to answer your question by searching through the knowledge base.

kapa.ai•12/12/25, 1:40 AM

----------------------
From the docs you provided, there’s no mention of a specific “horrible exploit” or a known, named vulnerability in Normcore that you’d be expected to manually patch. I don’t see any security advisory or exploit description in the official materials.

What the docs do say, relevant to cheating and security:

Normcore encrypts all packets by default using DTLS, so traffic isn’t sent in the clear over the network, which helps protect against eavesdropping and replay attacks.[Why Normcore]
Server‑side authority is handled primarily via ownership + lifetime flags; if your ownership rules aren’t set up carefully, clients can sometimes change more state than you intend, which could be perceived as “cheating.”[Ownership + lifetime]
For stronger cheat‑prevention or more complex authority needs, Normcore recommends Normcore Private with authoritative servers / server plugins so your own code on the server controls game logic and can reject suspicious actions.[Architecture FAQ; Authoritative servers]

So:

I’m not seeing any reference in the docs to a known, unpatched, critical exploit that would match what’s being described to you.
The more realistic concern is game‑specific cheating (e.g., a malicious client modifying their own state) if your ownership rules or server‑side validation aren’t strict enough, rather than a universal Normcore vulnerability.

Given that you’re being harassed and someone is making vague claims, the safest next steps are:

kapa.ai•12/12/25, 1:40 AM

Double‑check your usage of ownership and lifetime flags to ensure only appropriate clients can modify critical models.[Ownership + lifetime]
If you’re on or considering Normcore Private, evaluate whether you need an authoritative server or server plugins to enforce more logic server‑side.[Normcore Private; Server plugins]
Reach out to Normal directly (support or Discord) with any concrete exploit details you’re given so they can confirm whether it’s real and, if so, how to mitigate it.[Docs home; Common questions]

Without more specific technical information from the people making the claim, the knowledge sources you shared don’t indicate a known, named exploit you’re “supposed” to fix.
----------------------
Note: you can ask me a follow up question by @ mentioning me again

----------------------

kapa.ai•12/12/25, 1:40 AM

@1095079234759823521 Kapa.ai is still learning and improving, please let me know how I did by reacting below.

maxweisel•12/12/25, 1:41 AM

I'm not aware of any horrible exploit in Normcore (obviously if I was we would fix it immediately). That said, a big thing that can help a lot is to implement the Oculus server to server entitlement check API and only provide the app key to the build when that check passes. That will ensure modified builds cannot access any servers.

Mmaxweisel I'm not aware of any horrible exploit in Normcore (obviously if I was we would f...

OrbitOP•12/12/25, 1:42 AM

Is this possible using the free version of Normcore?

maxweisel•12/12/25, 1:47 AM

Yes nothing here requires Normcore Pro, but regardless of what plan you have you need to run your own server to perform the S2S authentication part