CVE-2026-86199

PocketMine-MP, the open-source server implementation for Minecraft: Bedrock Edition, fails in versions before 5.43.1 to properly validate the Certificate field supplied during offline login authentication. An unauthenticated player can connect and send a login packet with a malformed or unexpected Certificate field, triggering an uninitialized property access error that terminates the server process. The impact is denial of service only: the crash disconnects all connected players, with no confidentiality or integrity impact, reflected in the CVSS 4.0 vector's High availability impact and overall score of 8.7. Any operator running an affected PocketMine-MP version that accepts offline (non-Xbox Live-authenticated) logins is exposed, which includes the many small community servers built on the platform. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade to PocketMine-MP 5.43.1 or later. Operators who cannot upgrade promptly should consider switching to online (Xbox Live-authenticated) mode so the offline login path is not used, and configure automatic server restarts to limit downtime from crashes. Monitor for new advisories or public PoCs, since unauthenticated pre-authentication crashes are typically easy to weaponize once published.