Vulnerability · Published Sep 7, 2026 · Assigned by VulnCheck
CVE-2022-51016PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay
Medium 6.1
In plain English
A medium-severity security flaw in PocketMine-MP from pmmp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | 4.0.0 | GHSA-h79x-98r2-g6qc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pmmp | PocketMine-MP | 3.0.0 – before 3.27.0 |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-h79x-98r2-g6qc) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay third-party-advisory