CVE-2024-56141 describes a cryptographic vulnerability in Bixilon's Minosoft client where the AES cipher's initialization vector (IV) is set equal to the secret key rather than a random value. This predictable IV usage in CBC mode violates cryptographic best practices (CWE-329) and exposes the encryption to chosen-plaintext and chosen-ciphertext attacks. An attacker capable of submitting specific messages for encryption may recover the secret key. The issue affects all versions supporting Minecraft protocol 1.7 and later. No official fix or mitigation has been published, and no workarounds are known.

The vulnerability allows attackers with the ability to submit chosen plaintext or ciphertext to recover the secret AES key due to the predictable IV. This compromises the confidentiality and integrity of encrypted communications within the affected Minosoft client. The CVSS 3.1 score of 5.0 reflects a medium severity impact with network attack vector, high attack complexity, low privileges required, and no user interaction needed.

No official patch or workaround is currently available for this vulnerability. Users and administrators should monitor the vendor's advisories for updates. Until a fix is released, avoid using the affected Minosoft versions in security-sensitive environments where encryption confidentiality is critical.