The vulnerability allows an attacker to bypass authentication checks for FULL type tokens in the CloudburstMC Protocol library. The missing validation in EncryptionUtils can be exploited to generate or replay tokens that the library accepts as valid, potentially granting unauthorized access or manipulating session state. The flaw is identified as CWE‑287 and does not directly affect confidentiality or integrity, but enables privilege escalation or unauthorized operations within systems that rely on the protocol for authentication.

Affected installations use CloudburstMC Protocol library before version 3.0.0.Beta12‑20260420.182526‑15. Publicly accessible applications and services built for Minecraft Bedrock Edition that incorporate this library are potentially impacted.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting limited widespread exploitation. The likely attack vector is remote, via network traffic that includes crafted FULL type authentication tokens. An attacker needs to supply a valid token format but does not require privileged execution. Successful exploitation permits bypassing authentication safeguards in the protocol library.