The vulnerability lies in an OAuth redirect endpoint that hard‑codes a localhost URL and omits PKCE and state validation, creating a credential‑exposure weakness (CWE‑287). When a user initiates a Microsoft account login, sensitive tokens may be stored or logged locally, which an attacker with the ability to observe or intercept the local communication could acquire, enabling credential reuse or unauthorized account access.

The issue affects all releases of XianYuLauncher earlier than 1.5.5. Versions 1.5.5 and newer incorporate PKCE and state checks and are not susceptible to this flaw.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% reflects a very low likelihood of active exploitation, and the flaw is not listed in CISA’s KEV catalog. Nonetheless, exploitation requires a local attack vector—typically the presence of a malicious process on the same device that can intercept loopback traffic. In environments where multiple users share the same machine or where untrusted software can establish local connections, the risk profile rises. Promptly applying the vendor’s fix mitigates this risk. If an update cannot occur immediately, the risk remains until a suitable workaround is implemented.