CVE-2026-48991

MediumCVSS 5.5/10Last modified Jun 22, 2026

Description

XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated login under certain local attack conditions. Affected versions relied on a fixed localhost redirect URI without PKCE or state validation. Exploitation is most likely to occur when an attacker is able to observe, intercept, or otherwise interfere with the local authentication flow on the same device. This issue has been fixed in version 1.5.5.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jun 17, 2026
Last modified
Jun 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-489945.9ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a mCVE-2026-489957.5pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm CVE-2026-489966.1Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filterCVE-2026-489977.1e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize dCVE-2026-489985.3guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation whenCVE-2026-489995.7Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containiCVE-2026-49005.3A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.CVE-2026-490007.0An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, oCVE-2026-490015.3Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inCVE-2026-490029.1Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access sCVE-2026-490039.6Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and becoCVE-2026-490046.5The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service