CVE-2022-51016 PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay
Attackers can replay captured login tokens to impersonate players and bypass authentication on PocketMine-MP servers lacking encryption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-51016?
CVE-2022-51016 is a medium-severity authentication bypass vulnerability in pmmp PocketMine-MP, published on 7 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.
Weakness: CWE-294
Which versions are affected by CVE-2022-51016?
2 open source packages ship an affected version, including pocketmine/pocketmine-mp.
| Package | Affected | Fixed in |
|---|---|---|
pocketmine/pocketmine-mp Packagist | From 3.0.0 | 4.0.0 |
pocketmine/pocketmine-mp Packagist | From 3.0.0 | 4.0.0 |
How do I fix CVE-2022-51016?
Upgrade pocketmine/pocketmine-mp to 4.0.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-51016 being exploited?
There is no known exploitation of CVE-2022-51016 in the wild and no public exploit code.
Sources
Also known as GHSA-h79x-98r2-g6qc, GHSA-xc6f-r2f5-fwj7.