PocketMine-MP CVE-2026-86199

Exploitation requires the target server to be running in offline authentication mode, which accepts self-signed JWT certificate chains without Xbox Live verification - this is the default for many community and LAN servers. The attacker must be able to reach the server's Minecraft Bedrock network port (default UDP 19132). No credentials, active session, or prior player registration are needed. Exploitation is not possible against online-mode servers (Xbox Live authentication), as those route through a different certificate validation code path unaffected by this flaw. No non-default feature enablement is required beyond the server simply accepting offline logins.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) accurately characterizes this as a trivially exploitable, zero-barrier denial-of-service. No authentication, no special privileges, and no user interaction are required; any client reachable to the server's Bedrock UDP port can trigger the crash with a single malformed packet. The public PoC referenced in GHSA-g2fj-p69p-9chp significantly elevates practical risk for unpatched deployments, as the attack is immediately reproducible by unskilled actors. The impact is bounded to availability - the CVSS VC:N/VI:N confirm no confidentiality or integrity exposure. EPSS data was not provided; however, given the zero-complexity exploitation path and public PoC, real-world exploitation of exposed servers is likely. CISA KEV listing is not confirmed. The risk is particularly acute for public gaming servers that rely on PocketMine-MP uptime for player services.

An attacker sends a LoginPacket to a PocketMine-MP server running in offline mode, with the Certificate field set to a JSON payload that, when mapped to a LegacyAuthChain object, leaves internal properties uninitialized. The server's handleLogin() method proceeds to access those uninitialized properties, triggering a fatal PHP error that crashes the entire server process. Because a public PoC is referenced in the GHSA advisory, this requires minimal tooling and can be repeated to keep the server in a perpetual crash loop.