Description

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T14:17:20.980Z",
  "pubdate": "2026-09-09T14:17:20.980Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.43.1 contain a vulnerability related to improper validation of the Certificate field during the offline login authentication process. This flaw allows an unauthenticated remote attacker to trigger an uninitialized property access error, leading to a denial-of-service (DoS) condition.\nThe vulnerability resides in the server's authentication handling logic, where malformed or crafted authentication packets bypass validation checks. By sending specifically crafted payloads, an attacker can force the server to attempt access to an uninitialized property, causing an immediate runtime exception.\nThis vulnerability is particularly critical as it does not require prior authentication or privileged access to the server, making it highly exploitable over the network. Successful exploitation results in the unexpected termination of the server process, impacting service availability for all users.\nThere are no specific requirements for account access or complex prerequisites, as the attack leverages the protocol-level processing of login requests. Organizations running affected versions are exposed to remote crashes, which can be easily automated by malicious actors to disrupt operations.",
  "technicalDetails": "The vulnerability stems from insufficient bounds checking and validation logic within the authentication subsystem of PocketMine-MP during the handshake process. Specifically, the server fails to verify the integrity and structure of the Certificate field provided during an offline login attempt.\nWhen a client initiates a connection, the server processes the authentication packets. In affected versions, the logic responsible for parsing the Certificate field does not sufficiently ensure that the object or property associated with the certificate is correctly instantiated before consumption. If a crafted packet is sent that omits expected fields or provides malformed data, the authentication routine proceeds to reference an uninitialized property.\nThis access attempt triggers a PHP runtime exception. Because the error occurs within the core network handling thread without proper exception management for this specific failure state, the server process enters an unrecoverable state, resulting in an immediate crash of the PocketMine-MP instance.\nThe attack flow is as follows: 1) An unauthenticated attacker initiates a standard login sequence as defined by the PocketMine-MP network protocol. 2) The attacker crafts a login payload containing a malformed or missing Certificate field. 3) The server's authentication component receives the payload and attempts to parse the fields. 4) The parser encounters an uninitialized property due to the missing data structure. 5) The resulting exception is unhandled, causing the server application to terminate.\nBecause the server must process these initial login packets to determine if a connection should be accepted, it is inherently exposed to any remote actor capable of reaching the server's listening port. There is no requirement for the attacker to have an established session, valid credentials, or any elevated privileges, as the trigger occurs during the pre-authentication phase of the network handshake.\nThe impact is limited to a denial-of-service condition; there is no documented evidence of remote code execution (RCE) or data exfiltration resulting from this specific uninitialized property access. However, the ease of exploitability and the catastrophic effect on service continuity necessitate immediate patching of the affected network handling component."
}