CVE-2025-54120: PCL Community Edition exposes login credentials in logs
PCL (Plain Craft Launcher) Community Edition is a Minecraft launcher. In PCL CE versions 2.12.0-beta.5 to 2.12.0-beta.9, the login credentials used during the third-party login process are accidentally recorded in the local log file. Although the log file is not automatically uploaded or shared, if the user manually sends the log file, there is a risk of leakage. This is fixed in version 2.12.0-beta.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54120?
CVE-2025-54120 has a medium severity rating due to the potential exposure of login credentials.
How do I fix CVE-2025-54120?
To fix CVE-2025-54120, upgrade the Plain Craft Launcher Community Edition to version 2.12.0-beta.10 or later.
What versions of PCL are affected by CVE-2025-54120?
CVE-2025-54120 affects PCL Community Edition versions 2.12.0-beta.5 through 2.12.0-beta.9.
What kind of data is exposed in CVE-2025-54120?
CVE-2025-54120 exposes users' login credentials in local log files.
Is CVE-2025-54120 a remote or local vulnerability?
CVE-2025-54120 is a local vulnerability, as it involves the logged credentials on the user's device.