Vulnerability · Published Jun 17, 2026 · Assigned by GitHub_M

CVE-2026-48991XianYuLauncher: Legacy Microsoft account OAuth sign-in flow lacks PKCE and state validation

Medium 5.5

In plain English

A medium-severity improper authentication in XianYuLauncher from XianYuLauncher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 97.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated login under certain local attack conditions. Affected versions relied on a fixed localhost redirect URI without PKCE or state validation. Exploitation is most likely to occur when an attacker is able to observe, intercept, or otherwise interfere with the local authentication flow on the same device. This issue has been fixed in version 1.5.5.

Affected products (as reported)

Vendor	Product	Versions
XianYuLauncher	XianYuLauncher	< 1.5.5

Weakness: CWE-287 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://github.com/XianYuLauncher/XianYuLauncher/security/advisories/GHSA-q6r9-qxmf-8hfx x_refsource_CONFIRM
https://github.com/XianYuLauncher/XianYuLauncher/pull/213 x_refsource_MISC