Two unpatched zero-day vulnerabilities in NTE allow for full account takeover

A security investigation of Neverness to Everness (NTE) found that its login traffic on port 30031 uses unencrypted Google FlatBuffers data, exposing authentication details including a user ID and UUID-format secret. An attacker on the same local network could use ARP spoofing to intercept a player’s login. The captured data has no effective replay protection: it can be reused from another IP, even days later, to obtain a session token. The researcher also demonstrated a full takeover by intercepting their own login and replacing its credentials with the victim’s user ID and secret; the server accepted the modified request despite other client-specific information. Shared networks such as cafés, campuses, and LAN parties are identified as potential settings for interception.

The exploit chain combines two flaws: cleartext transmission of sensitive information (CWE-319) and insufficient session expiration or replay protection (CWE-613). Both CVE requests were pending at publication, and the vulnerabilities remained unpatched. The researcher says the findings, proof-of-concept code, and demonstrations were reported to Perfect World/Hotta Studio on May 8, 2026. The company acknowledged the report and said a fix was in progress, but follow-ups through October found the issues unresolved. The findings and exploit tooling were published on October 27, more than 170 days after the initial disclosure.