CVE-2026-86199CWE-184

CVE-2026-86199

High · published September 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00467 · 39.5th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-09-09T18:17Z
References (5)
https://github.com/pmmp/PocketMine-MP/commit/8c75a1d739e8e190d3cc2338b25cebcc9c052b1b · [email protected]https://github.com/pmmp/PocketMine-MP/commit/e4aaef4ee0f769b52dc0347a1d6da403b9691115 · [email protected]https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g2fj-p69p-9chp · [email protected]https://www.vulncheck.com/advisories/pocketmine-mp-before-5.43.1-denial-of-service-via-unauthenticated-login · [email protected]https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g2fj-p69p-9chp · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:32Z
    PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
    cvelistv5