CVE-2022-51016
Received Received - Intake

PocketMine-MP Session Replay Authentication Bypass

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2022-51016
EUVD
EUVD-2022-56045

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
pocketmine mp From 3.27.0 (exc)
pocketmine mp 4.0.0
pocketmine mp to 3.27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PocketMine-MP 3.x versions before 3.27.0 lack Minecraft Bedrock protocol encryption. This allows attackers to capture a valid login token from a victim's session by tricking them into connecting to a malicious server. The attacker can then replay this token to impersonate the victim and bypass Xbox Live authentication until the token expires, typically within 2-3 days.

Detection Guidance

Detecting this vulnerability requires checking if your PocketMine-MP server version is below 3.27.0 or 4.0.0. Use commands like 'grep' to inspect version files or server logs. For example: grep -r 'version' /path/to/server | grep -i 'pocketmine'. Monitor network traffic for unencrypted login tokens or replay attempts.

Impact Analysis

If you run an internet-facing PocketMine-MP server without encryption, attackers could impersonate players on your server. Players connecting to malicious servers could have their login tokens stolen and reused to access other servers as those players. The impact lasts until the token expires, which is usually 2-3 days.

Compliance Impact

This vulnerability primarily impacts authentication security by allowing impersonation through replay attacks. While it does not directly violate GDPR or HIPAA, it could indirectly affect compliance by enabling unauthorized access to personal data if exploited. Organizations using vulnerable PocketMine-MP versions may face increased risk of data breaches, which could lead to regulatory penalties under GDPR (e.g., unauthorized data access) or HIPAA (e.g., compromised patient information).

Mitigation Strategies

Upgrade PocketMine-MP to version 3.27.0 or 4.0.0 immediately. If upgrading is not possible, use an encryption-supporting proxy like gophertunnel. Verify serverAddress fields in LoginPacket to prevent replay attacks. Disable internet-facing servers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-51016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart