CVE-2026-48991 Overview
CVE-2026-48991 affects XianYuLauncher, a Minecraft Java Edition launcher, in all versions prior to 1.5.5. The flaw exposes sensitive authentication artifacts during user-initiated login under local attack conditions. Affected versions rely on a fixed localhost redirect URI without Proof Key for Code Exchange (PKCE) or state parameter validation. An attacker with the ability to observe or interfere with the local OAuth flow on the same device can capture authentication tokens. The maintainers fixed the issue in version 1.5.5. The weakness is classified under [CWE-287] Improper Authentication.
Critical Impact
A local attacker who can interact with the loopback authentication flow may capture authentication artifacts and impersonate the victim's Minecraft account.
Affected Products
- XianYuLauncher versions prior to 1.5.5
- Minecraft Java Edition login workflows handled by the affected launcher
- Systems where multiple local users or processes share access to loopback interfaces
Discovery Timeline
- 2026-06-17 - CVE-2026-48991 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-48991
Vulnerability Analysis
XianYuLauncher implements OAuth-style login by listening on a fixed localhost redirect URI. The launcher accepts the authorization response on this loopback endpoint and exchanges it for tokens. Because the implementation omits PKCE and does not validate a state parameter, the flow cannot bind an authorization response to the specific login session that initiated it. Any local process able to bind or race the same localhost port, or otherwise observe the redirect, can capture the authorization code or token returned by the identity provider. The captured artifacts can then be used to impersonate the user against Microsoft account services tied to Minecraft Java Edition.
Root Cause
The root cause is a missing authentication control in the OAuth client implementation. Without PKCE, the authorization code is not cryptographically bound to the requesting client instance. Without state validation, the launcher cannot detect cross-session or injected responses. The fixed loopback redirect URI further removes any per-session entropy that would otherwise frustrate local interception.
Attack Vector
Exploitation requires local access and user interaction. The attacker must run code on the same device while the victim initiates a login. Plausible techniques include binding the loopback port ahead of the launcher, intercepting traffic on the loopback interface, or reading process or browser artifacts that contain the redirect URL with the authorization code. The vulnerability does not yield code execution or data tampering, but it does expose confidential authentication material.
No verified public exploit code is available. See the GitHub Security Advisory and the GitHub Pull Request for technical details of the fix.
Detection Methods for CVE-2026-48991
Indicators of Compromise
- Unexpected processes binding to the launcher's loopback redirect port around the time of user login
- Local packet capture tooling such as Wireshark or tcpdump active on the loopback interface during authentication
- Minecraft or Microsoft account sign-in events from unfamiliar IP addresses shortly after a local login attempt
- Installation of XianYuLauncher versions earlier than 1.5.5 on managed endpoints
Detection Strategies
- Inventory endpoints for XianYuLauncher binaries and parse version metadata to flag installations below 1.5.5
- Monitor for non-launcher processes opening listeners on loopback ports historically used by the launcher's redirect URI
- Correlate launcher process execution with concurrent execution of packet capture drivers or proxy tools on the same host
Monitoring Recommendations
- Alert on Microsoft account sign-ins that occur from a new device or geolocation soon after launcher activity on an endpoint
- Track creation of child processes by XianYuLauncher and any sibling processes that touch the same loopback port
- Forward endpoint process and network telemetry to a centralized analytics platform for retrospective hunting against the indicators above
How to Mitigate CVE-2026-48991
Immediate Actions Required
- Upgrade all XianYuLauncher installations to version 1.5.5 or later
- Require affected users to sign out of their Microsoft account and re-authenticate after upgrading
- Restrict the use of unverified launcher builds on shared or multi-user systems until the patched version is deployed
Patch Information
The issue is fixed in XianYuLauncher 1.5.5. The corresponding code change is tracked in the upstream GitHub Pull Request, which introduces PKCE and state validation around the OAuth flow. Administrators should obtain the release directly from the project repository and verify the version string before deployment.
Workarounds
- Avoid initiating logins on shared workstations, terminal servers, or systems running untrusted local software
- Block third-party packet capture and local proxy tools on endpoints used for Minecraft authentication
- If upgrade is not possible, refrain from using the launcher and authenticate through an official Mojang or Microsoft client instead
# Example: verify installed version on Windows via PowerShell
Get-ItemProperty "$env:LOCALAPPDATA\XianYuLauncher\*.exe" |
Select-Object Name, VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
