CVE-2022-51016: PocketMine-MP Authentication Bypass

CVE-2022-51016 Overview

CVE-2022-51016 is an authentication bypass vulnerability in PocketMine-MP, a server software for Minecraft: Bedrock Edition. Versions of the 3.x branch prior to 3.27.0 do not implement Minecraft Bedrock protocol encryption. As a result, the server cannot verify that a connecting client possesses the private key associated with its login token. An attacker who captures a valid login from another player can replay that login to impersonate the victim and pass XBOX Live authentication until the JSON Web Token (JWT) expires, typically after 2 to 3 days. The issue is tracked under [CWE-294] Authentication Bypass by Capture-Replay and was fixed in 4.0.0, with a backport to 3.27.0.

Critical Impact
An attacker who obtains a captured login payload can impersonate arbitrary players against internet-exposed PocketMine-MP servers without knowing their credentials.

Affected Products

PocketMine-MP 3.x prior to 3.27.0
PocketMine-MP 4.x pre-release versions prior to 4.0.0
Deployments exposed directly to the internet without an encryption-enabled proxy in front

Discovery Timeline

2026-09-07 - CVE-2022-51016 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2022-51016

Vulnerability Analysis

PocketMine-MP relies on the Minecraft Bedrock login flow, in which a client presents a chain of JWTs signed by XBOX Live identity services. In a compliant implementation, the server issues an encryption handshake challenge that the client must sign with the private key corresponding to the public key embedded in the login JWT. This step binds the JWT to the actual connection.

The 3.x branch omits this encryption handshake entirely. The server accepts any client that presents a syntactically valid JWT chain, without proving possession of the matching private key. Any captured login payload therefore functions as a bearer token for the duration of the JWT validity window.

An attacker can lure a victim to connect to an attacker-controlled server, harvest the login payload from that session, then replay it against a legitimate PocketMine-MP server. The victim's XBOX Live identity is trusted, granting the attacker whatever in-game permissions, inventory, or administrative privileges the victim holds.

Root Cause

The root cause is missing protocol-level cryptographic binding between the login JWT and the network session. Without the Bedrock encryption handshake, session establishment does not include a proof-of-possession check on the private key referenced by the JWT.

Attack Vector

Exploitation requires network reachability to a vulnerable server and access to a captured login payload from the targeted victim. User interaction is needed to obtain that payload, for example by tricking the victim into joining an attacker-controlled server. Servers behind a proxy that terminates encryption correctly are not exposed.

text

// Patch excerpt: composer.json adds ext-crypto to enable Bedrock encryption
       "php": "^8.0",
       "php-64bit": "*",
       "ext-chunkutils2": "^0.3.1",
+      "ext-crypto": "^0.3.1",
       "ext-ctype": "*",
       "ext-curl": "*",
       "ext-date": "*",

Source: PocketMine-MP commit d28be4e

Detection Methods for CVE-2022-51016

Indicators of Compromise

Multiple successful logins for the same XBOX Live identity originating from different source IP addresses within the JWT validity window (typically 2-3 days).
Player sessions that exhibit sudden changes in client build, device model, or locale fields while presenting the same identity JWT.
Server logs showing repeated joins from the same Xbox User ID (XUID) shortly after a player interacted with an unknown or untrusted server.

Detection Strategies

Correlate PocketMine-MP session logs with source IP and device fingerprints to flag replay patterns across accounts.
Alert on logins where the presented JWT was previously observed against a different remote endpoint.
Monitor administrative command usage by accounts that recently connected from anomalous geographies.

Monitoring Recommendations

Forward PocketMine-MP connection and authentication logs to a centralized analytics platform for longitudinal analysis.
Track the running PocketMine-MP version across all deployments and alert on any host below 3.27.0 or 4.0.0.
Baseline expected client IP ranges for administrator accounts and alert on deviations.

How to Mitigate CVE-2022-51016

Immediate Actions Required

Upgrade PocketMine-MP to 4.0.0 or apply the 3.27.0 backport that enables Bedrock protocol encryption.
Install the ext-crypto PHP extension (^0.3.1) required by the patched builds.
Audit administrator accounts for unexpected logins during the exposure window and rotate any privileged in-game roles.

Patch Information

The fix is delivered in PocketMine-MP 4.0.0 and backported to 3.27.0. The change adds the ext-crypto PHP extension dependency in composer.json and enables the Bedrock encryption handshake so that clients must prove possession of the private key associated with their login JWT. Full details are available in the GitHub Security Advisory GHSA-h79x-98r2-g6qc and the VulnCheck advisory.

Workarounds

Place the PocketMine-MP server behind a reverse proxy that terminates the Bedrock protocol with encryption enabled, rather than exposing the server directly to the internet.
Restrict inbound access to the server port via firewall allowlists so only trusted clients can reach the service until patching is complete.
Advise players not to connect to untrusted servers using accounts that also access production PocketMine-MP deployments.

bash

# Update PocketMine-MP and install the required crypto extension
composer require pocketmine/pocketmine-mp:^3.27.0
pecl install crypto-0.3.1
echo "extension=crypto.so" | sudo tee /etc/php/conf.d/crypto.ini
php -r "echo extension_loaded('crypto') ? 'ok' : 'missing';"