PT-2026-89002

CVE-2026-86199

Published

2026-09-09

Updated

2026-09-13

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.43.1

Description An issue exists during offline login authentication where the software fails to properly validate the Certificate field. Unauthenticated players can exploit this to trigger an uninitialized property access error, which results in a server crash.

Recommendations Update to version 5.43.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Dktapps

Kostamax27

Vendors

Affected products

Weakness enumeration

CWE-184: Incomplete List of Disallowed Inputs