CVE-2026-86199: Pmmp Pocketmine-Mp

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.

Affected products

• Pmmp Pocketmine-Mp: before 5.43.1 (fixed in 5.43.1)

Published 2026-09-09. Last modified 2026-09-09.