What Is the MiniMessage Exploit? How One Chat Click Could Hand Over a Minecraft Server

The short version: Many Minecraft server chat plugins passed raw player messages through MiniMessage, PaperMC’s text formatting API. That let anyone write their own clickable text. A message that looked like “/rewards” could run any command with the permissions of whoever clicked it, including /op. Exploit groups used it to take over servers and wreck in-game economies before chat plugins patched it in early 2026, and bypasses kept appearing after the first fixes.

What is MiniMessage?

MiniMessage is the text format PaperMC (the most popular Minecraft server software) offers plugin developers. Simple tags like <red> or <bold> style text, and interactive tags add hover tooltips and click actions. Click actions can open a link or run a chat command as the player who clicks.

How does the exploit work?

Chat plugins are only supposed to apply MiniMessage to the server’s own text. Plugins that ran player-written chat through the parser let players write interactive tags themselves.

1. The attacker sends a chat message styled like a normal server notice, for example a “claim your /rewards” prompt.
2. Hidden behind the text is a click event that runs a different command, such as /op attacker.
3. Any player who clicks runs that command as themselves. When it is a staff member or owner, the attacker gets their permissions.

Opening links shows a confirmation prompt, but running commands has no built-in protection. That is why the attack targeted staff.

What did it do to real servers?

The exploit was found and publicised by members of Autism Inc, a Minecraft exploit-research community. They credit its discovery to Khao and LifeIsLinux, and say later bypasses were found by Bright6f and Piccaxe. Server owner and YouTuber TheMisterEpic documented its impact in two videos.

• In the first, he demonstrated live on a pay-to-win server how one disguised message could move huge sums between player accounts and collapse the economy. The group behind it reported trying the exploit on hundreds of servers and gaining operator access on dozens. Those figures come from the group and have not been independently verified.
• In the second, he showed how the same trick, smuggled through a trade plugin’s item names, hit his own OG Network. Escaping chat alone was not enough: any text players control can carry a payload.

How do server owners fix it?

1. Update your chat, trade, nickname and mail plugins. Most popular plugins shipped patches once the exploit went public.
2. Never parse raw player input with MiniMessage. For custom code, use escapeTags() to show tags as plain text, or stripTags() to remove them.
3. If players may use colours, use a restricted parser that only allows colour and decoration tags, never click or hover events.
4. Check every place players can type: item names, signs, books, nicknames, shop and trade listings, and messages bridged from Discord.
5. Train staff not to click player-sent links or commands, and keep operator status off everyday staff accounts.

What it means

The MiniMessage exploit shows how much of Minecraft multiplayer security depends on plugin authors handling text safely. Vanilla Minecraft wasn’t broken. A convenience feature used carelessly across hundreds of plugins was. Expect exploit groups to keep probing every input players control, and expect servers that stay patched and give staff limited permissions to be the ones that survive it.

More server security coverage in Security & Exploits, including DonutSMP’s sign translation mod scanner.