CVE-2021-39177: User impersonation due to incorrect handling of the login JWT

September 7, 2021 (updated October 1, 2026)

This allows anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any Bedrock user. Unless credentials are saved in your configuration, online mode is not affected as users are still required to log in separately. If your credentials are saved, there is no risk of exposing your email or password.

References

github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6
github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858
github.com/advisories/GHSA-h77f-xxx7-4858
nvd.nist.gov/vuln/detail/CVE-2021-39177
updates.playhive.com/changelog/weekend-maintenance-breakdown

Code Behaviors & Features

Detect and mitigate CVE-2021-39177 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →