EUVD-2026-318028

fkie_cve-2026-42188

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.

GHSA-xcfg-fcr5-gw9r — Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser

Affected: Maven: org.geysermc.geyser:core

### Summary A server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client.

### Details Geyser allows Bedrock clients to interact with Java Edition mechanics, including the creation of custom player heads using the minecraft:profile NBT structure.

When a player head is created with a custom textures property, Geyser processes the Base64-encoded JSON value and forwards the embedded texture URL for resolution. However, the URL contained in the textures.SKIN.url field is not sufficiently validated. ### PoC

1. **Setup Environment:** - Set up a Minecraft Server (Paper/Spigot) with the latest version of Geyser installed. - Ensure you have a Bedrock client connected.

2. **Prepare Listener:** - Go to [webhook.site](https://webhook.site) and obtain a unique URL (e.g., `https://webhook.site/YOUR-UUID`).

3. **Construct Payload:** - Create a JSON payload pointing to your listener URL: `{"textures":{"SKIN":{"url":"https://webhook.site/YOUR-UUID"}}}` - Encode this JSON string to Base64. *(You can use a terminal command: `echo -n '{"textures":{"SKIN":{"url":"..."}}}' | base64`)*

4. **Execute Command:** - Run…

Most recent entries from all

EUVD-2026-318028

fkie_cve-2026-42188

GHSA-xcfg-fcr5-gw9r — Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser