EUVD-2026-34032Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Beta12-20260420.182526-15, CloudburstMC Protocol is partially missing validation for FULL type authentication tokens (Cloudburst/Protocol). This vulnerability impacts publicly accessible software depending on the affected versions of Protocol, specifically the EncryptionUtils methods to validate auth payloads for FULL type tokens. This issue has been patched in version 3.0.0.Beta12-20260420.182526-15.
AnalysisAI
Authentication bypass in CloudburstMC Protocol, the Minecraft Bedrock Edition protocol library, allows remote unauthenticated attackers to partially bypass token validation by exploiting incomplete checks in EncryptionUtils for FULL type authentication tokens. All versions prior to 3.0.0.Beta12-20260420.182526-15 are affected, impacting any publicly accessible software - such as Bedrock-compatible game servers - that depends on this library's auth payload validation logic. The CVSS vector (AV:N/AC:L/PR:N/UI:N/I:L) confirms low-complexity remote exploitation with limited integrity impact; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CloudburstMC Protocol is an open-source Java library implementing the Minecraft Bedrock Edition network protocol, used by server software to handle client connections. Authentication in Bedrock uses JSON Web Token (JWT) chains to verify client identity; FULL type tokens represent one authentication mode within this chain. The vulnerability, classified under CWE-287 (Improper Authentication), arises from incomplete input validation inside the EncryptionUtils class when processing FULL type auth payloads - meaning certain token fields or structural checks required for proper authentication verification are not enforced. The affected CPE is cpe:2.3:a:cloudburstmc:protocol:*:*:*:*:*:*:*:*, indicating all versions of the library prior to the patched release. The root cause is a validation gap rather than a cryptographic break, meaning a crafted or malformed payload can pass authentication checks that should otherwise reject it.
RemediationAI
The primary fix is to upgrade CloudburstMC Protocol to version 3.0.0.Beta12-20260420.182526-15 or later, which introduces complete validation for FULL type authentication token payloads in EncryptionUtils. Server operators using this library as a dependency (e.g., via Maven or Gradle) should update their dependency declaration to reference this release and rebuild or redeploy. The vendor advisory at https://github.com/CloudburstMC/Protocol/security/advisories/GHSA-g2fr-c75x-4hf9 should be consulted for any additional guidance. If an immediate upgrade is not feasible, a compensating control would be to restrict public network access to the Bedrock server (e.g., whitelist known client IPs at the firewall level), though this significantly limits server accessibility and is not appropriate for public-facing deployments. There are no other documented workarounds; the fix is solely in the patched library version.
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack. Rated critical
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. Rat
GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the net
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec
Denial of service in the Perl Protocol::HTTP2 module versions up to and including 1.12 lets remote unauthenticated attac
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to
Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. Rated high severity
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Rated high severity (CVSS 7.5), th
The dag-pb codec can panic when decoding invalid blocks. Rated high severity (CVSS 7.5), this vulnerability is remotely
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project.
go-libp2p is the offical libp2p implementation in the Go programming language. Rated high severity (CVSS 7.5), this vuln
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today