Skip to content

1.7.4

Latest
Latest

Choose a tag to compare

View all tags
@ragauskl ragauskl released this 25 Sep 22:42
v1.7.4
0a6aa71
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

New changes since last pre-release marked with NEW

Features

  • Added optional manual pairing confirmation - devices require approval on both ends, with a matching code shown on each before acceptance. This setting will be enabled by default for new users.
  • Added optional connection secret restricting connections to known instances; when unset, a built-in secret is used as a baseline check so connections remain protected against unprepared attempts to tamper with the connection
  • Added a popup quick settings setup for new users as well as users updating to this version or above first time to notify of the available security changes

Security

Added in 1.7.4-prerelease.2

Cursr was originally built for initial audience of home network users where every device is trusted, and hardening these areas was already planned for the point where usage moved beyond that. Thanks to Keiran "Affix" Smith reporting the issues below, that work was prioritized.

The issues affect 1.7.4-prerelease.1 and earlier versions, they can only be reached from the same local network. Full details are published under each CVE.

  • Authentication fixed on peer-to-peer HTTPS endpoints — CVE-2026-38685, CVE-2026-38686, CVE-2026-38688, CVE-2026-38690, CVE-2026-38693
  • Authentication fixed on UDP discovery messages, and the information they carry reduced — CVE-2026-38687, CVE-2026-38689, CVE-2026-38692
  • TLS certificate validation fixed, now checked against the certificate pinned during pairing — CVE-2026-38694
  • Removed dead code from an earlier unreleased transport prototype. Nothing used the endpoint, and certificates were not secret material in use — CVE-2026-38691

Fixes

  • Fixed app freezing or slowing down when trying to connect 6 or more devices
  • Fixed mouse position detection on KVM connection settle and when device is disconnected
  • Fixed incorrect caps lock state when clipboard shortcuts are used remotely
  • NEW Windows: Virtual switch authentication secret sometimes fails to set or reset while Cursr is running as admin and/or after user switch on device, so added an error explaining to wait and try again
  • NEW Fixed connected devices sometimes getting dropped when another device joined or came back from sleep, usually on WiFi

Other

  • Added button for easier reset/clear of old logs
  • Allow changing timeout for how long a device can be unresponsive before Cursr will assume it's offline and disconnect it
  • Some performance improvements mostly visible on larger KVM connections
  • Changed font for Machine ID to differentiate number 0 from letter O to reduce manual input mistakes
  • Added option to completely disable KVM so it wouldn't listen to the network or be capable of receiving TCP/UDP messages
  • Requests carry a per-session sequence stamp: replayed and stale ones (outside of small reordering window) are rejected
  • Updated EULA to contain more detailed explanation of how, what and for how long support may be offered, as well as how long the older versions will be hosted by Bitgapp
  • Moved KVM Instance ID to the bottom of settings under debug section so users would be less likely to confuse it with the Machine ID
  • In-app trial increased to 20min
  • Added 'Disconnect All' option to disconnect all connected devices in one go from tray/menu icon context menu
  • App will not auto reconnect on in-app network changes such as selection, port change, enable - allowing user to first make all required changes and connect as needed
  • Improved connection self-healing
  • Windows: Cursr can now be set to run as admin from settings. Settings shows whether it currently is, with 'Restart as Admin' and 'Restart without Admin', and an 'Always Run as Admin' option that starts Cursr with admin rights at logon
  • Windows: a warning is shown when an app running as admin takes focus, because Windows stops Cursr seeing mouse input while one is in front
  • If KVM gets disabled on connected device, control of mouse is handed back to the device mouse is attached to rather than staying invisible on remote that can't act on the input anymore until its state is resolved
  • Improved click tracking across devices
  • If KVM fails to start 'errored' state is shown in settings status
  • Added launch argument '--help' that prints any usable options at launch time by the user
  • Added launch arguments '--debug-cat' and '--debug-item' (more granular) to turn on debug logging, for when logs are needed but the app closes before settings can be opened
  • The paired devices list shows instance IDs when entries share a machine ID
  • Added handling for Windows and macOS user log out and switching, so Cursr disconnects and reconnects on session change (not supported in Linux)
  • NEW 'Connection to KVM peer lost' no longer is shown on other devices when a device is put to sleep or shut down
  • NEW Once connected, 'Rescan' button and tray item menu option will now be available to check network for new connections
  • NEW When a new device can't connect to all connected devices, the existing connection is kept
  • NEW When manually starting a connection from a device that some other devices can't reach, the devices that can reach the initiator are kept
Assets 18
Loading