Authentication Bypass in XianYuLauncher via Local Redirect

Compliance Impact

The vulnerability in XianYuLauncher prior to version 1.5.5 exposes sensitive authentication artifacts during user-initiated login under certain local attack conditions. This exposure could potentially lead to unauthorized access to user authentication data.

Such exposure of sensitive authentication information may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data to prevent unauthorized access and ensure user privacy.

However, the vulnerability is limited to local attack scenarios where an attacker can observe or interfere with the local authentication flow on the same device, which may reduce the overall risk depending on the environment.

The issue has been fixed in version 1.5.5, so updating to this version or later is necessary to mitigate compliance risks related to this vulnerability.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in XianYuLauncher, a Minecraft Java Edition launcher, in versions prior to 1.5.5. It involves the exposure of sensitive authentication artifacts during a user-initiated login process under certain local attack conditions. This happens because the affected versions use a fixed localhost redirect URI without implementing PKCE (Proof Key for Code Exchange) or state validation, which are security measures designed to protect the authentication flow.

An attacker who can observe, intercept, or interfere with the local authentication flow on the same device may exploit this vulnerability to gain access to sensitive authentication information.

This issue has been fixed in version 1.5.5 of XianYuLauncher.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of sensitive authentication artifacts, which may allow an attacker with local access to the device to intercept or steal authentication credentials during the login process.

Such exposure could result in unauthorized access to the user's account or services associated with the launcher, potentially compromising user data or access rights.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update XianYuLauncher to version 1.5.5 or later, where the issue has been fixed.

Avoid using affected versions prior to 1.5.5, especially in environments where an attacker could observe or interfere with the local authentication flow.

Useful 0 Not Useful 0