GravitLauncher CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL GravitLauncher CVE published 2026-09-17

CVE-2026-54617

CVE-2026-54617 is a critical vulnerability in GravitLauncher, an open-source Minecraft launcher. An unauthenticated remote actor can send a raw HTTP request to the default LaunchServer file server on port 9274, allowing them to read any file accessible to the LaunchServer process. This can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens a [truncated]