TOWER OF FANTASY · TECH-202611-m3kbaq · Vendor
NO FIX YET · SEE WHAT TO DO
A researcher (hun.io) showed that the Tower of Fantasy game client (Hotta Studio / Perfect World Games) sends the account's User ID and User Secret unencrypted over TCP port 30031, and the secret keeps working until the player fully logs out. Anyone on the same network (shared Wi-Fi, LAN via ARP spoofing) can capture it, replay it, and load it into their own launcher to play as the victim. Reported to the vendor 25 Jun 2026; still unpatched when published on 6 Nov 2026, with proof-of-concept code on GitHub. CVEs pending. The researcher found the same issues earlier in Hotta Studio's Neverness to Everness (NTE). No attacks in the wild reported.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Who cares technique
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.