Is CVE-2022-51016 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-51016 being exploited in the wild.

How severe is CVE-2022-51016?

Medium severity, with a CVSS score of 6.1, published 7 September 2026.

Which products and versions are affected?

pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=4.0.0.

Is there a fix for CVE-2022-51016?

Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-51016 attacked?

It is attacked over the network.

Am I affected by CVE-2022-51016?

Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-51016: PocketMine-MP login replay vulnerability without protocol encryption

CVE-2022-51016 · Severity: medium · CVSS 6.1 · Published 2026-09-07

PocketMine-MP is a Minecraft Bedrock server that allows players to connect and play online. Versions 3.x before 3.27.0 do not encrypt the login protocol, allowing attackers who capture a valid player login (by tricking them to connect to an attacker-controlled server) to replay that login and impersonate the victim for up to 2-3 days until the authentication token expires.

Technologies: pocketmine/pocketmine-mp (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2022-51016 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-51016 being exploited in the wild.
How severe is CVE-2022-51016?: Medium severity, with a CVSS score of 6.1, published 7 September 2026.
Which products and versions are affected?: pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=4.0.0.
Is there a fix for CVE-2022-51016?: Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-51016 attacked?: It is attacked over the network.
Am I affected by CVE-2022-51016?: Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pocketmine/pocketmine-mp (Packagist): upgrade to 4.0.0 or later
```
composer require pocketmine/pocketmine-mp:^4.0.0
```

Technical details

This is an authentication bypass vulnerability stemming from incomplete implementation of the Minecraft Bedrock protocol. PocketMine-MP 3.x verifies JWT tokens signed by Microsoft but does not implement the required protocol encryption layer, which prevents verification that a connecting client actually possesses the private key matching its public key in the authentication token. An attacker who captures a login packet (via man-in-the-middle or social engineering) can replay it to the server without possessing the victim's private key. Without encryption, the server cannot detect this impersonation. The attack is limited to the JWT token expiry window (typically 2-3 days). Fixed in versions 3.27.0 and 4.0.0 by implementing protocol encryption.

Affected products

PocketMine PocketMine-MP 3.x before 3.27.0

Identifiers

CVE-2022-51016
GHSA-h79x-98r2-g6qc

Timeline

2022-01-21: disclosed
2022-01-21: patched: Backported to 3.27.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.