CVE-2026-48991

XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated login under certain local attack conditions. Affected versions relied on a fixed localhost redirect URI without PKCE or state validation. Exploitation is most likely to occur when an attacker is able to observe, intercept, or otherwise interfere with the local authentication flow on the same device. This issue has been fixed in version 1.5.5.

• CWE-287

• https://github.com/XianYuLauncher/XianYuLauncher/pull/213
• https://github.com/XianYuLauncher/XianYuLauncher/security/advisories/GHSA-q6r9-qxmf-8hfx

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48985pam_usb provides hardware authentication for Linux using ord…5.5
• CVE-2026-48986pam_usb provides hardware authentication for Linux using rem…4.7
• CVE-2026-48988markdown-it is a Markdown parser. Versions 14.1.1 and below …5.3
• CVE-2026-48989Windows-MCP is an open-source project that integrates AI age…8.9
• CVE-2026-4899A security flaw has been discovered in code-projects Online …2.4
• CVE-2026-48990joserfc is a Python library that provides an implementation …5.3
• CVE-2026-48994ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-48995pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a ma…7.5
• CVE-2026-48997e107 is a content management system (CMS). Versions 2.3.5 a…7.1
• CVE-2026-48998guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…5.3
• CVE-2026-48999Attackers carefully craft malicious scripts, such as JavaScr…5.7
• CVE-2026-4900A weakness has been identified in code-projects Online Food …5.5