CVE-2022-51016

    Dashboard / Vulnerabilities / CVE-2022-51016

    CVE-2022-51016

    Published: 7 Sept 2026Last Modified: 12 Sept 2026

    Summary: PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay

    Details: PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51016.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc, https://nvd.nist.gov/vuln/detail/CVE-2022-51016, https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.0-authentication-bypass-via-login-replay, https://github.com/pmmp/PocketMine-MP/commit/d28be4eaf24a890f7ef110a51181a3d806a6acca

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 03510333dcec34fa5a59191e8e9610a9da5765ef
    Fixed -d28be4eaf24a890f7ef110a51181a3d806a6acca

    Affected versions

    3.26.5
    3.26.4
    3.26.3
    3.26.2
    3.26.1
    3.26.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-51016 | CVE-DB