A server‑side request forgery vulnerability exists in Geyser versions prior to 2.9.3, triggered by a crafted Base64‑encoded skin texture URL supplied through the /give command. The vulnerability causes the Minecraft server to perform arbitrary HTTP GET requests to URLs that the attacker controls or that are internal to the server network. While it does not provide direct code execution, it can be used for reconnaissance, internal network probing, or exfiltration of data.

The affected product is GeyserMC Geyser, the bridge between Minecraft Bedrock and Java editions. All releases prior to 2.9.3 are susceptible. The vulnerability is exploitable on servers that allow Bedrock clients to use the /give command to set player head textures.

The CVSS score of 2.4 classifies the issue as low severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a Bedrock client that can run the /give command with a malicious texture URL. Although exploitation potential is limited compared to higher‑impact flaws, the SSRF could reach sensitive internal endpoints if the server network is improperly segmented.