Read the docs
TI-2021-16563 Aliases CVE-2021-39177GHSA-h77f-xxx7-4858

User impersonation due to incorrect handling of the login JWT

Priority MEDIUM 45CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.

Why it matters now

EPSS 0.01443 73rd percentileScored 2026-11-07
Fix Fixed org.geysermc:connector (Maven): 1.4.2-SNAPSHOT

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GeyserMCGeyserup to 1.4.1-SNAPSHOT—No fix listedCNA
—org.geysermc:connector (Maven)before 1.4.2-SNAPSHOT1.4.2-SNAPSHOTPatch availableGHSA-h77f-xxx7-4858
  • Geyser VendorGeyserMC Affected up to 1.4.1-SNAPSHOT Fixed in — No fix listed CNA
  • org.geysermc:connector (Maven) Vendor— Affected before 1.4.2-SNAPSHOT Fixed in 1.4.2-SNAPSHOT Patch available GHSA-h77f-xxx7-4858

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:*before 1.4.2VulnerableGeyserMC
  • cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:* Versions before 1.4.2 Vulnerable ·GeyserMC

Remediation

  • Fix · GHSA-h77f-xxx7-4858 org.geysermc:connector (Maven) Fixed in 1.4.2-SNAPSHOT Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39177
  2. 2026-10-03 Alias added: GHSA-h77f-xxx7-4858

References

Patch 2

Advisory 2

Other 2

  • TI-2026-30509 Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences