Minosoft’s CryptManager mistakenly sets the AES initialization vector to the secret key itself instead of a random value, a misuse classified as CWE‑329. This deterministic IV allows an attacker who can supply chosen plaintext or ciphertext to recover the secret key, compromising the confidentiality and integrity of all encrypted communication in that session.

The vulnerability affects all releases of the Minosoft client from Bixilon that include the CryptManager change introduced in commit f1ae30e2 and later. All versions supporting Minecraft protocol 1.7 and newer are impacted; no patched version is currently available and no workaround has been supplied.

The CVSS base score of 5 denotes moderate severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The issue is not listed in CISA’s KEV catalog. The likely attack vector is an attacker controlling or spoofing a Minecraft server that interacts with the client, prompting it to encrypt data that the attacker can analyze. Once the key is recovered, the attacker can decrypt past and future traffic and impersonate the client.