***IMPORTANT*** Hypixel Authentication Exploit (Any Username)

[Mobing]

Hey, I've recently discovered an exploit to log into any account while the minecraft auth was down.
Around 3 PM EST Minecraft Auth Servers went down but only hypixel was join able no other servers were. This made me and a friend come to the conclusion that they use a special auth or a fork. We attempted to log onto hypixel using a non-premium account and it worked. This is not for mal intent only for having some fun and getting a video out. It's fixed now as the auth is back up but it could be a major exploit if used in the wrong way.

Heres a video explaining it (from me)

 

[Mobing]

Please don't confuse this with the recent Session ID Spoofing with the old Mojang Auth

 

[Function]

So you could possibly login with the username hypixel under a cracked account and it would work? That's crazy.

 

[bb]

You should friend "Due" if thats you online rn

 

[Mobing]

So you could possibly login with the username hypixel under a cracked account and it would work? That's crazy.

Yes when mojang auth was down. We logged onto it but needed a password.

[DOUBLEPOST=1584405140][/DOUBLEPOST]

You should friend "Due" if thats you online rn

It's no longer working.
I friended me (iKylq) and a couple friends if you see the plank
https://plancke.io/hypixel/player/friends/Kyle[DOUBLEPOST=1584405156][/DOUBLEPOST]

You should friend "Due" if thats you online rn

My friend also got on "Banned"

 

[bb]

Yes when mojang auth was down. We logged onto it but needed a password.

[DOUBLEPOST=1584405140][/DOUBLEPOST]
It's no longer working.
I friended me (iKylq) and a couple friends if you see the plank
https://plancke.io/hypixel/player/friends/Kyle[DOUBLEPOST=1584405156][/DOUBLEPOST]
My friend also got on "Banned"

Why is the account online right now then lol

 

[Mobing]

Why is the account online right now then lol

Kyle isn't online?[DOUBLEPOST=1584405436][/DOUBLEPOST]

Why is the account online right now then lol

Plank may be messed up or smthn

 

[bb]

https://gyazo.com/522c8bc3c0d1f4ec59fa7a6a055a72e8

 

[Ghast]

https://gyazo.com/522c8bc3c0d1f4ec59fa7a6a055a72e8

It’s possibly cached for a certain amount of time to prevent overloading queries by spamming join and disconnect with the nefarious intent to overload the backend.

 

[Mobing]

https://gyazo.com/522c8bc3c0d1f4ec59fa7a6a055a72e8

That's where I last logged out.[DOUBLEPOST=1584405778][/DOUBLEPOST]

That's where I last logged out.

Or what ghast said yes

 

[Kryth]

I was accused by a player of spoofing for logging in with "Skeletons" on Hypixel

 

[Mobing]

I was accused by a player of spoofing for logging in with "Skeletons" on Hypixel

Yeah that's based from the Session ID Spoofing that recently happened.
This is nothing to do with Session ID Spoofing it's a new exploit I found[DOUBLEPOST=1584407731][/DOUBLEPOST]So if you wanna re create this you would have to wait till Mojang auth's are down[DOUBLEPOST=1584413453][/DOUBLEPOST]

Hey, I've recently discovered an exploit to log into any account while the minecraft auth was down.
Around 3 PM EST Minecraft Auth Servers went down but only hypixel was join able no other servers were. This made me and a friend come to the conclusion that they use a special auth or a fork. We attempted to log onto hypixel using a non-premium account and it worked. This is not for mal intent only for having some fun and getting a video out. It's fixed now as the auth is back up but it could be a major exploit if used in the wrong way.

Heres a video explaining it (from me)

Update - My hypixel forums account got a warning lmao because I reposted this

 

[Mobing]

As to my knowledge me and my friend were the only people who used this exploit.
We will try to recreate it when they go do again

 

[Violet]

As to my knowledge me and my friend were the only people who used this exploit.
We will try to recreate it when they go do again

Highly doubt that, chearful discord was blowing up with people using technoblade, 05, $ etc.

 

[Mobing]

Highly doubt that, chearful discord was blowing up with people using technoblade, 05, $ etc.

I think you are mistaken with the session id exploit a week ago.
You couldn't use technoblade etc because they had a 2fa.[DOUBLEPOST=1584458973][/DOUBLEPOST]

Highly doubt that, chearful discord was blowing up with people using technoblade, 05, $ etc.

This was only working on Hypixel.

 

[Violet]

I think you are mistaken with the session id exploit a week ago.
You couldn't use technoblade etc because they had a 2fa.[DOUBLEPOST=1584458973][/DOUBLEPOST]
This was only working on Hypixel.

They bruteforced the 2FA
[DOUBLEPOST=1584459109][/DOUBLEPOST]It was only on hypixel

 

[Mobing]

They bruteforced the 2FA
[DOUBLEPOST=1584459109][/DOUBLEPOST]It was only on hypixel

Good to know. I just wanted to be friends with my real name ign[DOUBLEPOST=1584478705][/DOUBLEPOST]!

 

[Sloth]

Mojang needs to figure out a way to ensure these kind of methods aren't possible in the future. Even if it's just one server, it can cause a lot of problems.

 

[Mobing]

Mojang needs to figure out a way to ensure these kind of methods aren't possible in the future. Even if it's just one server, it can cause a lot of problems.

Yeah. It was mainly hypixel's issue how they went to offline mode but lots of damage could of been done.
If it continues to happen people will bruteforce simon's password.