CVE-2026-125358
Received Received - Intake

WebSocket Origin Validation Flaw in Universal-modder

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125358
EUVD
EUVD-2026-120521

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rehan-remade universal-modder to e88f6876745427321eb755ebc98276063a962d8a (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1385 The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site WebSocket Command Execution flaw in the universal-modder tool. It occurs because the HostLink class in its passthrough example mods lacks WebSocket Origin validation. Any webpage open in a user's browser can connect to an unauthenticated loopback WebSocket and send malicious 'cmd' messages. These commands are executed with operator-level authority via WorldBridge.command(), allowing remote attackers to control a Minecraft server without authentication.

Detection Guidance

Check if the universal-modder is running on localhost port 25599 using netstat or ss commands. Look for unexpected WebSocket connections from browser tabs to 127.0.0.1:25599. Monitor logs for cmd messages or unauthorized commands executed via WorldBridge.command().

Commands: netstat -tulnp | grep 25599 or ss -tulnp | grep 25599. Check browser developer tools Network tab for WebSocket connections to localhost.

Impact Analysis

If you use universal-modder versions before commit e88f687, an attacker could trick you into opening a malicious webpage while the mod is active. This would let them execute arbitrary Minecraft commands with operator privileges, potentially granting themselves admin access, manipulating game state, spawning mobs, or causing other unauthorized actions in your Minecraft world.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized command execution with operator authority. GDPR requires protecting personal data and ensuring system integrity, while HIPAA mandates safeguarding sensitive health information. Unauthorized access to Minecraft commands could lead to data breaches or unauthorized modifications, compromising compliance.

Mitigation Strategies

Update universal-modder to commit e88f687 or later where Origin validation is implemented. Block localhost port 25599 in firewall rules if not needed. Disable passthrough examples if unused. Monitor for unauthorized cmd executions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125358. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...