---
id: "TECH-202611-m3kbaq"
page: "https://infrastack.ai/live/TECH-202611-m3kbaq"
kind: "technique"
aliases: []
title: "Unpatched Tower of Fantasy login flaw lets someone on your network steal and replay your game login to take over the account (public exploit code, no CVE yet)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Tower of Fantasy", "fixed": [], "vendor": "Perfect World Games / Hotta Studio"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-07T16:52:46+00:00"
updated_at: "2026-11-07T16:54:16+00:00"
sources: [{"source": "analyst", "url": "https://hunio.org/security/tof-account-takeover/", "first_seen_at": "2026-11-07T16:52:46+00:00", "cites": ["https://hunio.org/security/tof-account-takeover/"]}]
exploit_sources: []
---

# Unpatched Tower of Fantasy login flaw lets someone on your network steal and replay your game login to take over the account (public exploit code, no CVE yet)

Link for people: https://infrastack.ai/live/TECH-202611-m3kbaq (this .md is for agents)

A researcher (hun.io) showed that the Tower of Fantasy game client (Hotta Studio / Perfect World Games) sends the account's User ID and User Secret unencrypted over TCP port 30031, and the secret keeps working until the player fully logs out. Anyone on the same network (shared Wi-Fi, LAN via ARP spoofing) can capture it, replay it, and load it into their own launcher to play as the victim. Reported to the vendor 25 Jun 2026; still unpatched when published on 6 Nov 2026, with proof-of-concept code on GitHub. CVEs pending. The researcher found the same issues earlier in Hotta Studio's Neverness to Everness (NTE). No attacks in the wild reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Tower of Fantasy affected range not listed fixed no fixed version listed

## How to check

You play Tower of Fantasy (PC launcher HottaLaunch) on a shared or untrusted network. Unencrypted login traffic to the game server on TCP port 30031. Unknown saved accounts in HottaLaunch/UserData/cache/player_v3_0 or HottaLaunch/UserData/Config/Config.ini [User] section. Public PoC: github.com/1hunio/tof-account-takeover.

## Fix

No fix from the vendor yet. Only log in to Tower of Fantasy (and Neverness to Everness) on a trusted home network, not public or shared Wi-Fi. Fully log out and back in to get a new User Secret if you suspect your login was captured. Watch for a game update that fixes this.

## Timeline

- 2026-11-07T16:52:46+00:00 analyst https://hunio.org/security/tof-account-takeover/

## Documents

- [describes] Reusing Exploits to Hijack Tower of Fantasy Accounts https://news.ycombinator.com/item?id=50405744
- [describes] Reusing Exploits to Hijack Tower of Fantasy Accounts (hun.io) https://hunio.org/security/tof-account-takeover/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_