SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2023-54355

HIGH · CVSS 7.5 EPSS 0.22% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-09 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

PocketMine-MP versions prior to 5.3.1 and 4.23.1 are vulnerable due to improper validation of the identityPublicKey in LoginPackets, allowing attackers to bypass login verification with keys from unsupported curves or non-EC types. This vulnerability can lead to server crashes due to uncaught exceptions during ECDH key derivation. Organizations using affected versions should prioritize patching to mitigate potential disruptions and security risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
poc
GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2023-54355
Severity
HIGH
CVSS
7.5
EPSS
0.22%

Original NVD Description

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.