What’s Vulnerable › Vulnerabilities

CVE-2022-51016: PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-07 · updated 2026-10-08
• Weakness: CWE-294

Description

PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.

Affected products

• pmmp PocketMine-MP: from 3.0.0 before 3.27.0 — fixed in 3.27.0

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 3.27.0. Check the vendor advisory for mitigations.

References

• https://github.com/pmmp/PocketMine-MP/commit/d28be4eaf24a890f7ef110a51181a3d806a6acca
• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc
• https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.0-authentication-bypass-via-login-replay

Get alerted when CVE-2022-51016 or the next vulnerability affects your stack