What is the CVSS score of CVE-2026-48991?

CVE-2026-48991 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

XianYuLauncher CVE-2026-48991

MEDIUM

Improper Authentication (CWE-287)

2026-06-17 GitHub_M

Authentication Bypass Java Xianyulauncher

5.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local process required to race the OAuth redirect; victim must actively trigger login (UI:R); only confidentiality is impacted via token interception, with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 22:21 vuln.today

Analysis Generated

Jun 17, 2026 - 22:21 vuln.today

DescriptionCVE.org

XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated login under certain local attack conditions. Affected versions relied on a fixed localhost redirect URI without PKCE or state validation. Exploitation is most likely to occur when an attacker is able to observe, intercept, or otherwise interfere with the local authentication flow on the same device. This issue has been fixed in version 1.5.5.

AnalysisAI

XianYuLauncher, a Minecraft Java Edition launcher, exposes Microsoft OAuth authentication tokens to local attackers in all versions prior to 1.5.5 due to an OAuth 2.0 Authorization Code flow implemented without PKCE or state parameter validation. A local attacker running a concurrent process on the same machine can race the launcher's fixed localhost redirect URI to intercept the authorization code, then exchange it for valid Microsoft and Minecraft access tokens without any special privileges. Compounding the exposure, ClientToken was stored on disk in plaintext and JWT/Bearer tokens could be leaked into log output. No public exploit has been identified and this vulnerability is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-287 (Improper Authentication) arising from an incomplete OAuth 2.0 Authorization Code implementation. The launcher opened a fixed localhost redirect URI to receive the Microsoft authorization code after user login, but omitted both PKCE (RFC 7636) and the state parameter. Without PKCE, any local process that binds to the same port before the launcher receives the authorization code and can exchange it at Microsoft's token endpoint - the PKCE code_verifier that would normally bind the code to the originating client is absent. Without state validation, cross-site request forgery against the local redirect is also possible. Separately, the C

class TokenEncryption previously fell back to returning plaintext on encryption failure rather than throwing, and ClientToken was serialized to disk without encryption. The fix, visible in PR #213, migrates MicrosoftAuthService.cs to the MSAL library (Microsoft.Identity.Client), which handles PKCE natively, encrypts ClientToken via TokenEncryption.Encrypt() at save time, throws InvalidOperationException on encryption failure to block plaintext storage, and introduces SensitiveDataSanitizer.cs to redact Bearer tokens, JWTs, access/refresh tokens, and device codes from logs and error messages. Affected CPE: cpe:2.3:a:xianyulauncher:xianyulauncher::::::::.

RemediationAI

Upgrade to XianYuLauncher version 1.5.5, which resolves all facets of this issue: the Microsoft authentication service has been migrated to the MSAL library (Microsoft.Identity.Client) with native PKCE support, ClientToken is now encrypted at rest via TokenEncryption.Encrypt(), the encryption code path throws instead of silently returning plaintext on failure, and a new SensitiveDataSanitizer class redacts Bearer headers, JWT tokens, access/refresh tokens, and device codes from logs and error messages. The patch is documented at https://github.com/XianYuLauncher/XianYuLauncher/security/advisories/GHSA-q6r9-qxmf-8hfx and implemented in https://github.com/XianYuLauncher/XianYuLauncher/pull/213. If immediate upgrade is not possible, users should avoid initiating login on shared, multi-user, or potentially compromised machines, and restrict filesystem permissions on the launcher's account data directory to prevent unauthorized reads of the plaintext ClientToken.