Description

PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-07T13:17:23.607Z",
  "pubdate": "2026-09-07T13:17:23.607Z",
  "executiveSummary": "PocketMine-MP versions prior to 3.27.0 are susceptible to an authentication bypass vulnerability due to the absence of Minecraft Bedrock protocol encryption.\nThe vulnerability allows an attacker to perform a session replay attack by capturing valid login credentials from legitimate players.\nBy impersonating a victim, an unauthorized user can gain access to the server with the victim's identity and permissions.\nThis issue primarily impacts servers directly exposed to the internet without an intermediate proxy layer that enforces transport encryption.\nThe risk is significant as it permits unauthorized access to player accounts for the duration of the JWT token lifecycle, typically spanning 2-3 days.\nExploitation requires the attacker to intercept a valid login session, typically achieved by misleading a user into connecting to a malicious server, and subsequently replaying that packet sequence to the legitimate target server.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the PocketMine-MP server implementation to enforce mandatory encryption within the Minecraft Bedrock network protocol stack.\nIn a secure implementation, the server and client establish a shared secret key via an ECDH key exchange during the login process. This key is used to encrypt the session, ensuring that only the holder of the corresponding private key for the client's login token can successfully authenticate.\nBecause PocketMine-MP 3.x failed to implement this encryption, the server remains incapable of validating the cryptographic link between the connecting client and the identity claims provided within the login JWT (JSON Web Token).\nThe attack flow begins when an attacker lures a victim to connect to an attacker-controlled server. During this initial connection, the victim's client transmits its legitimate authentication tokens to the malicious server. The attacker intercepts these credentials, including the valid JWT, without needing to decrypt the payload due to the lack of enforced transport security.\nOnce the attacker possesses the victim's valid login tokens, they initiate a connection to the target PocketMine-MP server. The attacker replays the captured authentication sequence. Because the server does not verify the possession of the private key via protocol-level encryption, it treats the replayed credentials as authentic.\nThe server successfully validates the JWT, and the attacker is granted session access as the victim. This grants the attacker all privileges associated with the compromised account, such as inventory access, player-specific permissions, and social features.\nThe impact remains effective until the JWT token expires, which typically occurs within 48 to 72 hours. During this interval, the attacker has complete functional control over the victim's identity within the server environment.\nThis vulnerability is particularly dangerous for public-facing servers that lack an architectural buffer, such as a secure proxy (e.g., Waterfall or BungeeCord-equivalent for Bedrock) configured to mandate encryption between the proxy and the backend server."
}