Back to overview

CVE-2026-48991

MEDIUM
5.5
CVSS 3.1
Description
XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated login under certain local attack conditions. Affected versions relied on a fixed localhost redirect URI without PKCE or state validation. Exploitation is most likely to occur when an attacker is able to observe, intercept, or otherwise interfere with the local authentication flow on the same device. This issue has been fixed in version 1.5.5.

Metadata

CVE ID
CVE-2026-48991
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-26 23:26 UTC
Published
2026-06-17 21:32 UTC
Last updated
2026-06-17 21:32 UTC
Primary CWE
CWE-287
CWE-287: Improper Authentication
Vendor / Product
XianYuLauncher / XianYuLauncher
Sources
cve.org  ·  NVD

Severity & Metrics

5.5 MEDIUM CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products (1)
VendorProductPlatformVersions
XianYuLauncher XianYuLauncher — < 1.5.5
Weakness (CWE)
CWESourceDescription
CWE-287 cna CWE-287: Improper Authentication
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.5 MEDIUM 3.1 cna CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References (2)
Back to overview