Mojira Archive
MCL-24030

Minecraft Launcher doesn't hide accessToken argument from the command line when launching Minecraft: Java Edition client

Description of issue

Sometimes when the game crashed, the JVM crashes, not Minecraft: Java Edition crashes due to issue for graphic rendering or memory. In this case, a file .minecraft/hs_err_pidXXXXX.log is created, and the user uploads it to Minecraft communities to find a solution. Some users upload it to Mojang Bug Tracker.

However, the file contains important information for the account, especially accessToken. This means, the hackers can join to the server using your account, get banned from the server, or send request to the Mojang API Server to change nickname or skins, see histories for, (if you haven't migrated yet) migrate to their own Microsoft account.

Step to reproduce

Using a JVM crash

  1. Launch Minecraft: Java Edition client with after 18w30a.
  2. Wait for the window to appear.
  3. Press F3+Ctrl+C keys for 10 seconds.
  4. Crash the JVM.
  5. Open the file .minecraft/hs_err_pidXXXXX.log using a text editor.
  6. Find one of these and check the argument accessToken:
    • "Command Line" in the "S U M M A R Y" section
    • "java_command" of "VM Arguments" in the "P R O C E S S" section

Using a process management program like Task Manager

  1. Launch Minecraft: Java Edition client.
  2. Open a process management program (or enter the command to display a list of processes in the shell).
  3. Find the javaw.exe process which running Minecraft: Java Edition client.
  4. Display the command line and check the argument accessToken.

Expected result

Including the value of the accessToken argument, the important information for the account, doesn't appear in the file .minecraft/hs_err_pidXXXXX.log and the command line.

Fixed

NoEul

2024-01-28, 05:45 PM

2024-08-07, 11:08 PM

2024-08-07, 11:08 PM

0

3

Confirmed

1219477

argument, client, client-side, command-line, crash, crash-report, java-edition, jvm-crash, log-in, minecraft-java-edition, minecraft-launcher, privacy, security

2.16.12 (Legacy Windows), 2.16.12 (Win 10/11)

-