High severity7.4NVD Advisory· Published Aug 30, 2021· Updated Jun 17, 2026

CVE-2021-39177

Description

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.geysermc:connectorMaven	< 1.4.2-SNAPSHOT	1.4.2-SNAPSHOT

Affected products

ghsa-coords
pkg:maven/org.geysermc/connector
Range: < 1.4.2-SNAPSHOT
Geysermc/Geyserv5
Range: <= 1.4.1-SNAPSHOT

Patches

Vulnerability mechanics

References

github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6nvdPatchThird Party AdvisoryWEB
github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858nvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-h77f-xxx7-4858ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-39177ghsaADVISORY
updates.playhive.com/weekend-maintenance-disclosure-2kJMaYnvdThird Party AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.481
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000