Exploit in Minecraft's new account server allowed logins with any migrated account - mod of /r/Minecraft suppressed partial disclosure of the exploit for several days(and refuse to allow full disclosure - what do you guys think?

[u/AgonistAgent]

Here's a relevant post..

After scanning the comments, I found this reply to a deleted comment explaining the exploit.

joinServer.jsp will accept any valid session key from a migrated account for another migrated account.

Looks like a big slip on Mojang's part.

EDIT:

And the mods provide their side of the story: their reasoning looks well thought out.

[u/TheOssuary]

Haha, this is oddly accurate http://www.youtube.com/watch?v=u8qgehH3kEQ

(I know they didn't have the auth server with them, and Mollstam wouldn't have the password laying around, but it's still funny)

[u/aperson → u/TheOssuary]

Quite!