# CVE-2022-51016: PocketMine-MP login replay vulnerability without protocol encryption

Source: https://junglewise.ai/threats/cve-2022-51016-pocketmine-mp-login-replay-vulnerability-without-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-51016 · Severity: medium · CVSS 6.1 · Published 2026-09-07

PocketMine-MP is a Minecraft Bedrock server that allows players to connect and play online. Versions 3.x before 3.27.0 do not encrypt the login protocol, allowing attackers who capture a valid player login (by tricking them to connect to an attacker-controlled server) to replay that login and impersonate the victim for up to 2-3 days until the authentication token expires.

Technologies: [pocketmine/pocketmine-mp (Packagist)](https://junglewise.ai/threats/technologies/pocketmine-pocketmine-mp). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2022-51016 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-51016 being exploited in the wild.

**How severe is CVE-2022-51016?** Medium severity, with a CVSS score of 6.1, published 7 September 2026.

**Which products and versions are affected?** pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=4.0.0.

**Is there a fix for CVE-2022-51016?** Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-51016 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-51016?** Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pocketmine/pocketmine-mp (Packagist): upgrade to 4.0.0 or later

  ```sh
  composer require pocketmine/pocketmine-mp:^4.0.0
  ```


## Technical details

This is an authentication bypass vulnerability stemming from incomplete implementation of the Minecraft Bedrock protocol. PocketMine-MP 3.x verifies JWT tokens signed by Microsoft but does not implement the required protocol encryption layer, which prevents verification that a connecting client actually possesses the private key matching its public key in the authentication token. An attacker who captures a login packet (via man-in-the-middle or social engineering) can replay it to the server without possessing the victim's private key. Without encryption, the server cannot detect this impersonation. The attack is limited to the JWT token expiry window (typically 2-3 days). Fixed in versions 3.27.0 and 4.0.0 by implementing protocol encryption.

## Affected products

- PocketMine PocketMine-MP 3.x before 3.27.0

## Identifiers

- CVE-2022-51016
- GHSA-h79x-98r2-g6qc

## Timeline

- 2022-01-21: disclosed
- 2022-01-21: patched: Backported to 3.27.0

## References

- [https://github.com/pmmp/PocketMine-MP/commit/d28be4eaf24a890f7ef110a51181a3d806a6acca](https://github.com/pmmp/PocketMine-MP/commit/d28be4eaf24a890f7ef110a51181a3d806a6acca)
- [https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc](https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc)

## Related threats

- [PocketMine-MP denial of service in ModalFormResponsePacket handling](https://junglewise.ai/threats/cve-2026-86204-pocketmine-mp-denial-of-service-in-modalformresponsepacket)
- [PocketMine-MP item duplication via despawn entity attack race condition](https://junglewise.ai/threats/cve-2026-86203-pocketmine-mp-item-duplication-via-despawn-entity-attack-race)
- [PocketMine-MP network amplification in ActorEventPacket](https://junglewise.ai/threats/cve-2026-86202-pocketmine-mp-network-amplification-in-actoreventpacket)
- [PocketMine-MP denial of service in LoginPacket processing](https://junglewise.ai/threats/cve-2026-86201-pocketmine-mp-denial-of-service-in-loginpacket-processing)
- [PocketMine-MP denial of service in LoginPacket handler](https://junglewise.ai/threats/cve-2026-86200-pocketmine-mp-denial-of-service-in-loginpacket-handler)