What is the CVSS score of CVE-2026-48991?

CVE-2026-48991 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

XianYuLauncher CVE-2026-48991

MEDIUM

Improper Authentication (CWE-287)

2026-06-17 GitHub_M

Authentication Bypass Java Xianyulauncher

5.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local process required to race the OAuth redirect; victim must actively trigger login (UI:R); only confidentiality is impacted via token interception, with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 22:21 vuln.today

Analysis Generated

Jun 17, 2026 - 22:21 vuln.today

DescriptionCVE.org

XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated login under certain local attack conditions. Affected versions relied on a fixed localhost redirect URI without PKCE or state validation. Exploitation is most likely to occur when an attacker is able to observe, intercept, or otherwise interfere with the local authentication flow on the same device. This issue has been fixed in version 1.5.5.

AnalysisAI

XianYuLauncher, a Minecraft Java Edition launcher, exposes Microsoft OAuth authentication tokens to local attackers in all versions prior to 1.5.5 due to an OAuth 2.0 Authorization Code flow implemented without PKCE or state parameter validation. A local attacker running a concurrent process on the same machine can race the launcher's fixed localhost redirect URI to intercept the authorization code, then exchange it for valid Microsoft and Minecraft access tokens without any special privileges. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Establish local process on victim machine

Delivery

Identify fixed localhost OAuth redirect port

Exploit

Bind listener before launcher during victim login

Execution

Receive authorization code via intercepted redirect

Persist

Exchange code at Microsoft token endpoint without PKCE

Impact

Access victim Microsoft and Minecraft accounts

Access

Establish local process on victim machine

Delivery

Identify fixed localhost OAuth redirect port

Exploit

Bind listener before launcher during victim login

Execution

Receive authorization code via intercepted redirect

Persist

Exchange code at Microsoft token endpoint without PKCE

Impact

Access victim Microsoft and Minecraft accounts

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to have the ability to run an arbitrary process on the same local machine as the victim (AV:L) - this is the primary limiting condition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) accurately reflects that exploitation is constrained to local access and requires the victim to initiate a login session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a background process running on the victim's machine waits for the victim to click the Microsoft login button in XianYuLauncher. The attacker's process, knowing the fixed localhost redirect port, binds to it first; when Microsoft redirects the browser post-authentication, the attacker's listener receives the authorization code. …
Remediation	Upgrade to XianYuLauncher version 1.5.5, which resolves all facets of this issue: the Microsoft authentication service has been migrated to the MSAL library (Microsoft.Identity.Client) with native PKCE support, ClientToken is now encrypted at rest via TokenEncryption.Encrypt(), the encryption code path throws instead of silently returning plaintext on failure, and a new SensitiveDataSanitizer class redacts Bearer headers, JWT tokens, access/refresh tokens, and device codes from logs and error messages. … Detailed patch versions, workarounds, and compensating controls in full report.