TShock Security Escalation Exploit
ImpactAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.Because of this, if the following conditions are met a player may assume the login state of a previously connected player:The server has UUID login enabledAn authenticated player disconnectsA subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connectionThe server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected playerPatchesTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.WorkaroundsImplement a RemoteClient reset event handler in a plugin like so: