Vulnerability-Lookup

CVE-2021-39177 (GCVE-0-2021-39177)

Vulnerability from cvelistv5 – Published: 2021-08-30 23:00 – Updated: 2024-08-04 01:58

Title

User impersonation due to incorrect handling of the login JWT

Summary

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/GeyserMC/Geyser/security/advis…	x_refsource_CONFIRM
https://github.com/GeyserMC/Geyser/commit/b954150…	x_refsource_MISC
https://updates.playhive.com/weekend-maintenance-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
GeyserMC	Geyser	Affected: <= 1.4.1-SNAPSHOT	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:58:18.223Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Geyser",
          "vendor": "GeyserMC",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.4.1-SNAPSHOT"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-30T23:00:12.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
        }
      ],
      "source": {
        "advisory": "GHSA-h77f-xxx7-4858",
        "discovery": "UNKNOWN"
      },
      "title": "User impersonation due to incorrect handling of the login JWT",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-39177",
          "STATE": "PUBLIC",
          "TITLE": "User impersonation due to incorrect handling of the login JWT"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Geyser",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= 1.4.1-SNAPSHOT"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GeyserMC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-287: Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858",
              "refsource": "CONFIRM",
              "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
            },
            {
              "name": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6",
              "refsource": "MISC",
              "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
            },
            {
              "name": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY",
              "refsource": "MISC",
              "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-h77f-xxx7-4858",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-39177",
    "datePublished": "2021-08-30T23:00:12.000Z",
    "dateReserved": "2021-08-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T01:58:18.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-39177",
      "date": "2026-10-06",
      "epss": "0.01431",
      "percentile": "0.72186"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "515038BF-D294-47CE-B315-48E1C3CA2C13",
                  "versionEndExcluding": "1.4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading."
        },
        {
          "lang": "es",
          "value": "Geyser es un puente entre Minecraft: Bedrock Edition y Minecraft: Java Edition. Unas versiones de Geyser anteriores a 1.4.2-SNAPSHOT permiten a cualquiera que pueda conectarse al servidor falsificar un LoginPacket con un token JWT manipulado, permitiendo una suplantaci\u00f3n de identidad como cualquier usuario. La versi\u00f3n 1.4.2-SNAPSHOT contiene un parche para este problema. No se presentan soluciones conocidas aparte de la actualizaci\u00f3n"
        }
      ],
      "id": "CVE-2021-39177",
      "lastModified": "2024-11-21T06:18:48.060",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "HIGH",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 7.5,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.2,
            "impactScore": 5.2,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-08-30T23:15:07.070",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-287"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "515038BF-D294-47CE-B315-48E1C3CA2C13",
                    "versionEndExcluding": "1.4.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading."
          },
          {
            "lang": "es",
            "value": "Geyser es un puente entre Minecraft: Bedrock Edition y Minecraft: Java Edition. Unas versiones de Geyser anteriores a 1.4.2-SNAPSHOT permiten a cualquiera que pueda conectarse al servidor falsificar un LoginPacket con un token JWT manipulado, permitiendo una suplantaci\u00f3n de identidad como cualquier usuario. La versi\u00f3n 1.4.2-SNAPSHOT contiene un parche para este problema. No se presentan soluciones conocidas aparte de la actualizaci\u00f3n"
          }
        ],
        "id": "CVE-2021-39177",
        "lastModified": "2024-11-21T06:18:48.060",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-08-30T23:15:07.070",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T13:39:50+00:00",
      "cve": "CVE-2021-39177",
      "id": "CVE-2021-39177",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "User impersonation due to incorrect handling of the login JWT",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-39177.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2021-39177

Vulnerability from fkie_nvd - Published: 2021-08-30 23:15 - Updated: 2026-06-17 04:03

Severity

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858	Patch, Third Party Advisory
security-advisories@github.com	https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY	Third Party Advisory

Impacted products

	Vendor	Product	Version
	geysermc	geyser	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Geyser",
          "vendor": "GeyserMC",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.4.1-SNAPSHOT"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "515038BF-D294-47CE-B315-48E1C3CA2C13",
              "versionEndExcluding": "1.4.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading."
    },
    {
      "lang": "es",
      "value": "Geyser es un puente entre Minecraft: Bedrock Edition y Minecraft: Java Edition. Unas versiones de Geyser anteriores a 1.4.2-SNAPSHOT permiten a cualquiera que pueda conectarse al servidor falsificar un LoginPacket con un token JWT manipulado, permitiendo una suplantaci\u00f3n de identidad como cualquier usuario. La versi\u00f3n 1.4.2-SNAPSHOT contiene un parche para este problema. No se presentan soluciones conocidas aparte de la actualizaci\u00f3n"
    }
  ],
  "id": "CVE-2021-39177",
  "lastModified": "2026-06-17T04:03:15.263",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-08-30T23:15:07.070",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-H77F-XXX7-4858

Vulnerability from github – Published: 2021-09-07 23:04 – Updated: 2026-10-01 18:41

Summary

User impersonation due to incorrect handling of the login JWT

Details

Impact

This allows anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any Bedrock user. Unless credentials are saved in your configuration, online mode is not affected as users are still required to log in separately. If your credentials are saved, there is no risk of exposing your email or password.

Patches

This was patched as part of https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6 and https://github.com/GeyserMC/Geyser/commit/ab2f5b326fe590e09167e8b45b4b165ac06ecd13. if your Geyser version is 1.4.2-SNAPSHOT or later, the issue has been addressed on your build.

Workarounds

Geyser strongly recommends updating to fix this issue. If this isn't possible: - Use online mode and don't save credentials in your Geyser configuration - Use an additional authentication method on the Java server

References

This was disclosed to us by a staff member over at Hive; you can read their disclosure here: https://updates.playhive.com/changelog/weekend-maintenance-breakdown

For more information

If you have any questions or comments about this advisory: * Come talk to us over on our Discord server in the #development channel

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geysermc:connector"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2-SNAPSHOT"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39177"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-07T14:04:02Z",
    "nvd_published_at": "2021-08-30T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\u003c!--_What kind of vulnerability is it? Who is impacted?_--\u003e\nThis allows anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any Bedrock user. Unless credentials are saved in your configuration, online mode is not affected as users are still required to log in separately. If your credentials are saved, there is no risk of exposing your email or password.\n\n### Patches\n\u003c!--_Has the problem been patched? What versions should users upgrade to?_--\u003e\nThis was patched as part of https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6 and https://github.com/GeyserMC/Geyser/commit/ab2f5b326fe590e09167e8b45b4b165ac06ecd13. if your Geyser version is `1.4.2-SNAPSHOT` or later, the issue has been addressed on your build.\n\n### Workarounds\n\u003c!--_Is there a way for users to fix or remediate the vulnerability without upgrading?_--\u003e\nGeyser strongly recommends updating to fix this issue. If this isn\u0027t possible:\n- Use online mode and don\u0027t save credentials in your Geyser configuration\n- Use an additional authentication method on the Java server\n\n### References\n\u003c!--_Are there any links users can visit to find out more?_--\u003e\nThis was disclosed to us by a staff member over at Hive; you can read their disclosure here: https://updates.playhive.com/changelog/weekend-maintenance-breakdown\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Come talk to us over on our [Discord](https://discord.gg/geysermc) server in the [#development](https://discord.com/channels/613163671870242838/613170125696270357) channel",
  "id": "GHSA-h77f-xxx7-4858",
  "modified": "2026-10-01T18:41:47Z",
  "published": "2021-09-07T23:04:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39177"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/GeyserMC/Geyser"
    },
    {
      "type": "WEB",
      "url": "https://updates.playhive.com/changelog/weekend-maintenance-breakdown"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "User impersonation due to incorrect handling of the login JWT"
}

GSD-2021-39177

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-39177

Aliases

CVE-2021-39177

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-39177",
    "description": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.",
    "id": "GSD-2021-39177"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-39177"
      ],
      "details": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.",
      "id": "GSD-2021-39177",
      "modified": "2023-12-13T01:23:15.388062Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2021-39177",
        "STATE": "PUBLIC",
        "TITLE": "User impersonation due to incorrect handling of the login JWT"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Geyser",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c= 1.4.1-SNAPSHOT"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "GeyserMC"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-287: Improper Authentication"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858",
            "refsource": "CONFIRM",
            "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
          },
          {
            "name": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6",
            "refsource": "MISC",
            "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
          },
          {
            "name": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY",
            "refsource": "MISC",
            "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-h77f-xxx7-4858",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,1.4.1-SNAPSHOT]",
          "affected_versions": "All versions up to 1.4.1-snapshot",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-287",
            "CWE-937"
          ],
          "date": "2021-09-07",
          "description": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.",
          "fixed_versions": [
            "1.4.2-SNAPSHOT"
          ],
          "identifier": "CVE-2021-39177",
          "identifiers": [
            "GHSA-h77f-xxx7-4858",
            "CVE-2021-39177"
          ],
          "not_impacted": "All versions after 1.4.1-snapshot",
          "package_slug": "maven/org.geysermc/connector",
          "pubdate": "2021-09-07",
          "solution": "Upgrade to version 1.4.2-SNAPSHOT or above.",
          "title": "Improper Authentication",
          "urls": [
            "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-39177",
            "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6",
            "https://github.com/advisories/GHSA-h77f-xxx7-4858"
          ],
          "uuid": "9968f406-55b5-4caf-9487-86bd9538affd"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.4.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-39177"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858"
            },
            {
              "name": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6"
            },
            {
              "name": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2021-09-10T14:30Z",
      "publishedDate": "2021-08-30T23:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-39177 (GCVE-0-2021-39177)

FKIE_CVE-2021-39177

GHSA-H77F-XXX7-4858

Impact

Patches

Workarounds

References

For more information

GSD-2021-39177

Tags

Sightings

Nomenclature

Related by attack behaviour