Executive brief
Lost-Auction is a Minecraft server plugin that provides an auction house feature for players to buy and sell items. A vulnerability allows players to exploit the auction GUI to duplicate items or obtain restricted items like barrier blocks, compromising the integrity of the game economy and server progression systems.
Technical details
The vulnerability is a GUI manipulation vulnerability in the Lost-Auction auction plugin that allows players to take items from the auction interface in unintended ways, specifically enabling duplication and extraction of restricted items such as barrier blocks. The root cause lies in insufficient validation or state management of item transfers within the auction GUI interface. The vulnerability requires network access to a Minecraft server running the plugin and can be exploited by any player with normal server access. An attacker can duplicate valuable items or access normally restricted items, disrupting server balance and economy. The issue was fixed in commit 88c920b05042929db334ba06d57f052b42d6b3f8; users should update to versions after this commit.
Affected products
- MintyItanium Lost-Auction prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8
Timeline
- 2026-08-25: disclosed