CVE-2022-51016 in PocketMine-MP
Summary
by MITRE • 09/07/2026
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in PocketMine-MP versions prior to 3.27.0 represents a critical failure in authentication integrity within the Minecraft Bedrock Edition server software. The core technical flaw stems from the absence of encryption implementation for the Minecraft Bedrock protocol during the login phase, which fundamentally breaks the mutual verification process required to establish secure connections. In standard secure protocols, it is not sufficient for a client merely to present credentials; the system must cryptographically verify that the entity presenting those credentials possesses the corresponding private key associated with its identity token. By omitting this encryption layer and the subsequent cryptographic challenge-response mechanism, PocketMine-MP fails to bind the login session to the specific hardware or software instance of the connecting player. This omission creates a scenario where authentication is based solely on static tokens rather than dynamic proof-of-possession, rendering the system vulnerable to credential replay attacks.
The operational impact of this flaw allows an attacker with network access capabilities to perform sophisticated impersonation attacks against server users. Specifically, if an attacker can capture a valid login sequence from another player's session—potentially by tricking the victim into connecting to a malicious server controlled by the attacker—they obtain all necessary components for authentication without needing to crack passwords or exploit other software bugs. The captured data includes the Xbox Live token and associated identifiers required to authenticate with PocketMine-MP servers. Because the vulnerable server does not verify that the replaying client holds the private key linked to these tokens, it accepts the replayed credentials as legitimate. This enables the attacker to impersonate the victim player, gaining full access to their in-game identity, inventory, and permissions until the JSON Web Token expires, which typically occurs after two to three days depending on configuration.
This vulnerability primarily affects servers that are directly reachable over the internet without an intermediary proxy capable of handling TLS termination or encryption for the Bedrock protocol. Servers operating behind such proxies may be partially mitigated if the proxy enforces strict connection verification before forwarding traffic to the backend PocketMine-MP instance, but direct exposure leaves users at significant risk. The attack vector aligns with CWE-287 Improper Authentication and CWE-345 Insufficient Verification of Data Authenticity within common vulnerability classification standards. From a threat intelligence perspective, this behavior is consistent with ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate credentials to gain unauthorized access, as well as T1557 Adversary-in-the-Middle if the initial capture involves intercepting traffic between the client and an attacker-controlled server.
To mitigate this risk, administrators must upgrade PocketMine-MP to version 3.27.0 or later, where the encryption implementation has been restored, ensuring that clients are required to prove possession of their private keys during login. For environments unable to immediately patch due to compatibility constraints with plugins or other dependencies, deploying a reverse proxy such as Nginx or HAProxy configured to handle TLS termination for Bedrock connections can provide an additional layer of security by encrypting the traffic before it reaches the vulnerable application logic. Furthermore, network-level monitoring should be implemented to detect unusual patterns of authentication attempts from single IP addresses using multiple distinct user tokens, which may indicate active replay attacks in progress.