Vulnerability · Published Jul 23, 2025 · Assigned by GitHub_M
CVE-2025-54120PCL Community Edition exposes login credentials in logs
Critical 9.3
In plain English
A critical-severity sensitive data in logs in PCL2-CE from PCL-Community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
PCL (Plain Craft Launcher) Community Edition is a Minecraft launcher. In PCL CE versions 2.12.0-beta.5 to 2.12.0-beta.9, the login credentials used during the third-party login process are accidentally recorded in the local log file. Although the log file is not automatically uploaded or shared, if the user manually sends the log file, there is a risk of leakage. This is fixed in version 2.12.0-beta.10.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PCL-Community | PCL2-CE | >= 2.12.0-beta.5, < 2.12.0-beta.10 |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H