The vulnerability is an authentication bypass that allows an attacker to replay a captured login token from another player’s session. The server does not enforce encryption for the Minecraft Bedrock protocol, so it cannot confirm that the token belongs to the client. As a result, a replayed token will be accepted, and the attacker can impersonate the victim for the lifetime of the JSON Web Token, typically 2‑3 days. This flaw is identified as CWE‑294.

The flaw affects PocketMine‑MP servers running version 3.x before 3.27.0, including any instances that expose the Bedrock port directly to the internet without encryption. Versions 3.27.0, 4.0.0, and later contain the fix.

The CVSS score of 5.3 indicates moderate risk. Because the EPSS score is not available, the exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves capturing a live authentication packet from a legitimate player—often by tricking that player into connecting to a malicious server—and then replaying that packet against a target server. The flaw requires only the ability to observe network traffic and a public server to replay to, making it relatively easy for attackers with basic network access and foothold.