{"id":"TECH-202611-m3kbaq","kind":"technique","aliases":[],"related":[],"title":"Unpatched Tower of Fantasy login flaw lets someone on your network steal and replay your game login to take over the account (public exploit code, no CVE yet)","description":null,"summary":"A researcher (hun.io) showed that the Tower of Fantasy game client (Hotta Studio / Perfect World Games) sends the account's User ID and User Secret unencrypted over TCP port 30031, and the secret keeps working until the player fully logs out. Anyone on the same network (shared Wi-Fi, LAN via ARP spoofing) can capture it, replay it, and load it into their own launcher to play as the victim. Reported to the vendor 25 Jun 2026; still unpatched when published on 6 Nov 2026, with proof-of-concept code on GitHub. CVEs pending. The researcher found the same issues earlier in Hotta Studio's Neverness to Everness (NTE). No attacks in the wild reported.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tower of Fantasy","fixed":[],"vendor":"Perfect World Games / Hotta Studio"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"You play Tower of Fantasy (PC launcher HottaLaunch) on a shared or untrusted network. Unencrypted login traffic to the game server on TCP port 30031. Unknown saved accounts in HottaLaunch/UserData/cache/player_v3_0 or HottaLaunch/UserData/Config/Config.ini [User] section. Public PoC: github.com/1hunio/tof-account-takeover.","fix":"No fix from the vendor yet. Only log in to Tower of Fantasy (and Neverness to Everness) on a trusted home network, not public or shared Wi-Fi. Fully log out and back in to get a new User Secret if you suspect your login was captured. Watch for a game update that fixes this.","status":"open","published_at":null,"first_seen_at":"2026-11-07T16:52:46+00:00","triaged_at":"2026-11-07T16:52:46+00:00","updated_at":"2026-11-07T16:54:16+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':30A '2026':116B,124B '25':114B '30031':68B '6':122B 'account':22A,57B 'anyon':80B 'arp':91B 'attack':151B 'captur':94B 'client':49B 'code':25A,130B 'concept':129B 'cve':27A 'cves':133B 'earli':36B 'earlier':141B 'early-warn':35B 'ever':148B 'exploit':24A 'fantasi':4A,47B 'fantasy':34A 'fi':88B 'flaw':6A 'found':137B 'fulli':77B 'game':16A,48B,54B 'github':132B 'hotta':50B,143B 'hun.io':41B 'id':60B 'issu':140B 'jun':115B 'keep':72B 'lan':89B 'launcher':104B 'let':7A 'load':99B 'log':78B 'login':5A,17A 'm3kbaq':31A 'network':11A,84B 'never':146B 'nov':123B 'nte':149B 'of':33A 'pend':134B 'perfect':52B 'play':106B 'player':76B 'port':67B 'proof':127B 'proof-of-concept':126B 'public':23A 'publish':120B 'replay':14A,96B 'report':110B,155B 'research':40B,136B 'secret':63B,71B 'send':55B 'share':85B 'show':42B 'someon':8A 'spoof':92B 'steal':12A 'still':117B 'studio':51B,144B 'take':19A 'tcp':66B 'tech':29A 'techniqu':38B 'tower':2A,32A,45B 'unencrypt':64B 'unpatch':1A,118B 'user':59B,62B 'vendor':113B 'via':90B 'victim':109B 'warn':37B 'wi':87B 'wi-fi':86B 'wild':154B 'work':73B 'world':53B 'yet':28A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["offantasy","toweroffantasy"],"ptokens":["fantasy","of","tower"],"labels":["earlywarning","medium","technique","vendor"],"campaign_type":"exploitation","search_a":"'-202611':30A 'account':22A 'code':25A 'cve':27A 'exploit':24A 'fantasi':4A 'fantasy':34A 'flaw':6A 'game':16A 'let':7A 'login':5A,17A 'm3kbaq':31A 'network':11A 'of':33A 'public':23A 'replay':14A 'someon':8A 'steal':12A 'take':19A 'tech':29A 'tower':2A,32A 'unpatch':1A 'yet':28A","search_b":"'2026':116B,124B '25':114B '30031':68B '6':122B 'account':57B 'anyon':80B 'arp':91B 'attack':151B 'captur':94B 'client':49B 'code':130B 'concept':129B 'cves':133B 'earli':36B 'earlier':141B 'early-warn':35B 'ever':148B 'fantasi':47B 'fi':88B 'found':137B 'fulli':77B 'game':48B,54B 'github':132B 'hotta':50B,143B 'hun.io':41B 'id':60B 'issu':140B 'jun':115B 'keep':72B 'lan':89B 'launcher':104B 'load':99B 'log':78B 'network':84B 'never':146B 'nov':123B 'nte':149B 'pend':134B 'perfect':52B 'play':106B 'player':76B 'port':67B 'proof':127B 'proof-of-concept':126B 'publish':120B 'replay':96B 'report':110B,155B 'research':40B,136B 'secret':63B,71B 'send':55B 'share':85B 'show':42B 'spoof':92B 'still':117B 'studio':51B,144B 'tcp':66B 'techniqu':38B 'tower':45B 'unencrypt':64B 'unpatch':118B 'user':59B,62B 'vendor':113B 'via':90B 'victim':109B 'warn':37B 'wi':87B 'wi-fi':86B 'wild':154B 'work':73B 'world':53B","search_c":"","first_public_at":"2026-11-06T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-m3kbaq","url":"https://hunio.org/security/tof-account-takeover/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-07T16:52:46+00:00","fetched_at":"2026-11-07T16:52:46+00:00","note":null,"cites":["https://hunio.org/security/tof-account-takeover/"]}],"documents":[{"id":96678,"url":"https://news.ycombinator.com/item?id=50405744","title":"Reusing Exploits to Hijack Tower of Fantasy Accounts","kind":"post","source":"hackernews","publisher":null,"text":"Reusing Exploits to Hijack Tower of Fantasy Accounts\nhttps://hunio.org/security/tof-account-takeover/\n\n2 points, 1 comments on Hacker News","published_at":"2026-11-07T16:17:13+00:00","relation":"describes","confidence":null,"note":null},{"id":96825,"url":"https://hunio.org/security/tof-account-takeover/","title":"Reusing Exploits to Hijack Tower of Fantasy Accounts (hun.io)","kind":"blog","source":"analyst","publisher":null,"text":"Researcher hun.io: Tower of Fantasy (Hotta Studio / Perfect World) sends login User ID and User Secret unencrypted over TCP port 30031 (CWE-319) with no replay protection; secret not rotated between sessions unless full logout (CWE-613). Attacker on same network (ARP spoofing) captures them, replays, and injects into launcher file HottaLaunch/UserData/cache/player_v3_0 (DPAPI with hardcoded entropy gfsa97538uoxdrwp shared with Neverness to Everness, XOR 0xAB) to play as the victim. Disclosed 25 Jun 2026; unpatched at publication 6 Nov 2026; CVEs pending. PoC: github.com/1hunio/tof-account-takeover. Same issues previously found in Neverness to Everness (NTE).","published_at":"2026-11-06T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}