Executive Summary

The vulnerability exists in XianYuLauncher, a Minecraft Java Edition launcher, in versions prior to 1.5.5. It involves the exposure of sensitive authentication artifacts during a user-initiated login process under certain local attack conditions. This happens because the affected versions use a fixed localhost redirect URI without implementing PKCE (Proof Key for Code Exchange) or state validation, which are security measures designed to protect the authentication flow.

An attacker who can observe, intercept, or interfere with the local authentication flow on the same device may exploit this vulnerability to gain access to sensitive authentication information.

This issue has been fixed in version 1.5.5 of XianYuLauncher.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of sensitive authentication artifacts, which may allow an attacker with local access to the device to intercept or steal authentication credentials during the login process.

Such exposure could result in unauthorized access to the user's account or services associated with the launcher, potentially compromising user data or access rights.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update XianYuLauncher to version 1.5.5 or later, where the issue has been fixed.

Avoid using affected versions prior to 1.5.5, especially in environments where an attacker could observe or interfere with the local authentication flow.

Useful 0 Not Useful 0