This vulnerability in the Gaudire Assassin game's '/addJugador' endpoint involves multiple improper input validation flaws (CWE-20). The 'keyJugador' and 'keyJugadorObjectiu' parameters lack authorization checks, enabling modification of any user's data. The 'punts' and 'numObjectiusEliminats' fields accept arbitrary values, allowing score falsification. The 'tokens' field permits self-assignment of administrative privileges without validation, leading to privilege escalation. Numeric fields accept excessively long values, potentially causing system crashes and denial-of-service. The 'urlImatge' parameter enables server-side requests to arbitrary URLs, risking exposure of internal IP addresses, internal services, local files, and unauthorized third-party API interactions. No patch or official remediation is currently documented.

An authenticated attacker can alter any user's identity and information, falsify game scores to illegitimately obtain prizes, escalate privileges to administrator level, cause denial-of-service by crashing the system with oversized inputs, and exploit server-side request forgery to access sensitive internal data and services. These combined issues severely compromise game integrity, user data confidentiality, and service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the '/addJugador' endpoint to trusted users only, implement strict input validation and authorization checks on all parameters, and monitor for abnormal activity related to score changes and privilege escalations. Avoid exposing the vulnerable endpoint publicly and consider network-level controls to limit server-side request forgery risks.