Spatial.io — host feature authorization gap (high-level)

Vulnerability report theme against Spatial.io (metaverse / session app): application-level denial of service tied to Pro / host features such as congregate-around-actor and respawn-others-in-hotspots.

What was wrong (class)

• Host-only tools were gated in part by client-side React Native checks (profile / bringUsersToMeHostToolAvailable-style logic) before sending Unity / session RPC messages.
• The RN index.android.bundle side was described as insufficiently integrity-protected / not the authoritative trust boundary.
• Unity RPC handlers for those features reportedly lacked equivalent server-side host authentication, so a modified client could invoke host actions.
• Effect class: broken access control (client-enforced authorization) leading to application-level DoS (forced congregate/respawn churn, elevated client GPU load, session disruption)—not a claim of server RCE in this summary.

Impact (abstract)

Non-host participants in a room could be harassed with repeated forced movement/respawn behavior; hosts and platforms suffer reliability and support costs. Framed in the source as financial/time and trust impact to the service.

Mitigations / lessons

• Enforce host capability checks on the server (or authenticated gRPC / REST) for every privileged session RPC; never trust a Boolean from the client bundle.
• Integrity-protect or eliminate sensitive authorization logic from modifiable JS bundles; assume clients are hostile.
• Rate-limit and anomaly-detect mass congregate/respawn RPCs per room.
• Prefer deny-by-default for host tools when auth headers / roles are missing.

Solve steps and PoC omitted.