MBTH Login Security

Name: MBTH Login Security
Availability: InStock
Author: Sueta

1.1

Secure your server, protect your players — login made safe and simple. ✅

·Plugin

Description Updates2 Version history2 Addons Discussion Reviews

1.1latestLogin Exploits Fixed.Oct 29, 2025
CRITICAL SECURITY UPDATE - v1.0.1 URGENT: All Users Must Update Immediately [HR][/HR] Critical Vulnerability Fixed A critical session hijacking exploit has been discovered and patched in this release. This vulnerability allowed attackers to disconnect legitimate players and bypass authentication on cracked servers. Severity: CRITICAL Impact: Complete authentication bypass Affected Versions: v1.0.0 and earlier Status: FIXED in v1.0.1 [HR][/HR] ️ What Was Fixed? The Exploit: · Attackers could join with the same username as an online player · Minecraft would kick the original player ("Logged in from another location") · The attacker could then access the server, completely bypassing password/PIN authentication · Made the entire security system useless The Fix: · Added pre-login username blocking system · Duplicate username attempts are now blocked BEFORE the original player is affected · Original player stays connected and receives a security notification · Comprehensive logging and admin alerts · Discord webhook integration for security events · Full audit trail with IP tracking [HR][/HR] What's New in v1.0.1 Security Enhancements: · ️ Pre-login duplicate username detection · Real-time security alerts for hijacking attempts · Enhanced logging system with full audit trails · Multi-layer notifications (console, in-game, admin, Discord) · Zero performance impact (< 0.1ms per connection check) Notifications: When an attack is attempted, the system now: · Blocks the attacker before they can join · Alerts the victim player in-game · Notifies all online admins · Logs everything to console with full details · Sends Discord webhook (if configured) [HR][/HR] How to Update · Download the new MBTHLoginSecurity-1.0.1.jar · Stop your server · Delete the old v1.0.0 JAR file · Upload the new v1.0.1 JAR to your plugins folder · Start your server · Done! Protection is automatic - no configuration needed No configuration changes required! No database migration needed! Fully backward compatible! [HR][/HR] Technical Details Implementation: · Uses AsyncPlayerPreLoginEvent to check usernames before connection · Maintains real-time tracking of online player usernames · Blocks duplicate username connections at the protocol level · Automatic cleanup on disconnect and plugin reload Performance: · Memory overhead: ~10KB per 100 players (negligible) · CPU overhead: < 0.1ms per connection check · Network overhead: None (except Discord webhooks during attacks) [HR][/HR] Testing Performed · Normal player joins work perfectly · Duplicate username attacks blocked successfully · Original players stay connected without disruption · All notifications working (console, in-game, Discord) · Legitimate reconnections work normally · Plugin reload tested and verified · Zero performance impact confirmed [HR][/HR] Documentation Complete documentation available on GitHub: · Session Hijacking Fix Guide - Technical deep dive (15+ pages) · Security Update Guide - Complete update instructions · Quick Fix Summary - One-page reference View Full Documentation [HR][/HR] Why Update Now? This is not just a feature update - it's a critical security patch. Without this update: · Your players can be kicked by anyone who knows their username · Attackers can bypass all authentication (passwords, PINs, everything) · Your server security is completely compromised on cracked mode With this update: · Players are fully protected from session hijacking · All authentication systems remain secure · Real-time detection and blocking of attacks · Complete audit trail for security monitoring [HR][/HR] Support If you encounter any issues: · Discord: Join Support Server · GitHub Issues: Report Problems · Documentation: Read the Guides [HR][/HR] Changelog v1.0.1 (Critical Security Update) · FIXED: Critical session hijacking vulnerability · ️ ADDED: Pre-login username blocking system · ADDED: Real-time security alerts · ADDED: Enhanced logging and audit trails · ADDED: Multi-layer notification system · IMPROVED: Zero performance overhead · ADDED: Comprehensive security documentation .SpoilerTarget">Spoiler: v1.0.0 (Previous Release) · Password authentication with SHA-256 · GUI PIN Vault system · Discord webhook integration · Alt account detection · Session management · Login method choice GUI · Complete admin toolset [HR][/HR] ACTION REQUIRED If you're running v1.0.0 on a cracked server, update IMMEDIATELY. This is a critical security fix that protects your players from session hijacking attacks. The vulnerability completely bypasses authentication and can be exploited by anyone. [HR][/HR] Downloads & Links Stay secure! - MBTH Studios Development Team [HR][/HR] Note: This update is mandatory for all servers running in cracked/offline mode. Premium-only servers are less affected but should still update for consistency and future-proofing.
1.0Implemented New Things.Oct 16, 2025
MBTH Login Security Advanced login security system for Minecraft servers PIN authentication • Premium player detection • Discord webhooks • Admin tools [HR][/HR] Features Core Security · Password Authentication - Secure SHA-256 hashed passwords · PIN Code System - Additional 4-digit PIN for extra security · GUI PIN Vault - Beautiful graphical PIN entry with custom balloon number heads · Session Management - Remember authenticated players (configurable duration) · Login Timeout - Auto-kick players who don't login in time · Failed Attempt Protection - Kick after too many wrong password/PIN attempts · Session Hijacking Protection - NEW! Prevents username takeover attacks Player Management · Premium Player Detection - Auto-authenticate paid Minecraft accounts · Login Method Choice - Players can choose between PIN or password login · Alt Account Detection - Automatic IP-based alt account tracking · Account Freezing - Temporarily lock suspicious accounts · Force Logout - Admin can force players to re-authenticate Customization · Custom Branding - Personalize server name, titles, and messages · Color Coded Messages - Professional UI with Minecraft color codes · Configurable Settings - Every feature can be enabled/disabled · Discord Webhooks - Rich embed notifications with colors and emojis ️ Admin Tools · Password Reset - Reset player passwords as admin · PIN Reset - Remove player PINs · Account Unregister - Completely delete player accounts · Freeze/Unfreeze - Lock and unlock accounts · Alt Checker - View all accounts from same IP · Config Reload - Hot-reload configuration without restart [HR][/HR] Installation · Download the latest MBTHLoginSecurity-1.0.1.jar · Place the JAR file in your server's plugins/ folder · Restart your server · Configure the plugin in plugins/MBTHLoginSecurity/config.yml · Reload with /mbthlsreload Requirements · Minecraft Server (Paper/Spigot) 1.20.1+ · Java 17+ · No dependencies required! [HR][/HR] Quick Start For Players First Time Join Code (Text): /register <password> <confirm-password> /setuppin <pin> <confirm-pin> Login Code (Text): /login <password> or use the GUI PIN Vault for quick login! For Admins Reset Player Password Code (Text): /resetpassword Steve newpass123 Check Alt Accounts Code (Text): /checkalt Steve Freeze Suspicious Account Code (Text): /freezeaccount Steve [HR][/HR] Commands Player Commands Command Description Usage /register Create new account /register <pass> <confirm> /login Login to account /login <password> /changepassword Change password /changepassword <old> <new> <confirm> /setuppin Create PIN code /setuppin <pin> <confirm> /verifypin Verify PIN /verifypin <pin> /changepin Change PIN /changepin <old> <new> <confirm> Admin Commands Command Description Permission /resetpassword Reset player password mbth.admin /resetpin Remove player PIN mbth.admin /unregister Delete player account mbth.admin /freezeaccount Lock player account mbth.admin /unfreezeaccount Unlock player account mbth.admin /forcelogout Force player logout mbth.admin /checkalt Check alt accounts mbth.admin /mbthlsreload Reload config mbth.admin [HR][/HR] Configuration Basic Setup Code (Text): # Server Branding server-name: "MBTH" # Login Settings max-login-attempts: 3 login-timeout-seconds: 60 # Session (Stay Logged In) session: enabled: true duration-minutes: 30 # PIN Code System pin-code: enabled: true required: true # Force all players to setup PIN length: 4 max-attempts: 3 # Premium Player Bypass premium-bypass: enabled: true # Auto-login for paid Minecraft accounts # Alt Detection alt-detection: enabled: true notify-admins: true Discord Webhooks Code (Text): discord: enabled: true login-webhook: "https://discord.com/api/webhooks/YOUR_ID/YOUR_TOKEN" registration-webhook: "https://discord.com/api/webhooks/YOUR_ID/YOUR_TOKEN" log-premium-login: true log-failed-attempts: true username: "MBTH Security" avatar-url: "" See DISCORD_WEBHOOK_GUIDE.md for setup instructions. [HR][/HR] Customization Custom Messages All messages support Minecraft color codes ( &a, &c, etc.): Code (Text): messages: welcome-premium: "&7Welcome to {server}! You have been automatically authenticated." login-success: "&a&l Successfully logged in!" register-success: "&a&l Successfully registered!" pin-verified: "&a&l PIN verified successfully!" Custom Titles Code (Text): titles: main-title: "&6✦ &e&lMBTH Security &6✦" subtitle: "&ePlease login to continue" scoreboard-title: "&6&lMBTH LOGIN SECURITY" [HR][/HR] Discord Integration The plugin sends beautiful rich embeds to Discord: Login Events (Green) · Player logged in with password · Player logged in with PIN · PIN verified successfully · Premium player auto-login Registration Events (Blue) · New player registered · PIN setup completed Security Alerts (Red) · Failed login attempts · Player kicked for too many attempts · Account unregistered by admin · Session hijacking attempts blocked No external plugins required! Uses native HTTP webhooks. [HR][/HR] ️ Security Features Password Protection · SHA-256 Hashing - Passwords are never stored in plain text · Salted Hashing - Each password has unique hash · Attempt Limiting - Configurable max attempts before kick · Session Validation - Prevents unauthorized access PIN Code Security · GUI-Based Entry - Secure graphical PIN pad · Number Balloons - Beautiful custom head textures · Attempt Tracking - Separate attempt counter for PIN · Optional/Mandatory - Can be required or optional · Easy Reset - Admins can reset forgotten PINs Alt Account Detection · IP Tracking - Monitors accounts from same IP · Main/Alt Labels - Identifies primary account · Admin Notifications - Alerts when alts join · Detailed Reports - View all accounts per IP Session Hijacking Protection NEW! · Pre-Login Username Check - Blocks duplicate usernames before connection · Real-Time Detection - Instant attack detection and blocking · Multi-Layer Alerts - Console, in-game, admin, and Discord notifications · Zero Impact - Original player stays connected · Full Audit Trail - Complete logging with IP tracking [HR][/HR] Premium Player Detection The plugin automatically detects premium players (those who purchased Minecraft): · Auto-Login - Premium players skip authentication · No Registration - No password/PIN needed · Instant Access - Immediate gameplay · Secure - Uses Minecraft's built-in authentication Code (Text): premium-bypass: enabled: true # Enable auto-login for premium players Note: Only works on servers in online mode. [HR][/HR] Login Method Choice Players with both password and PIN can choose their login method through a beautiful GUI
10 downloads