# [Splatoon 3] Kick other players with NplnLogin message

Forged NplnLogin messages to other users' IDs or Pools bypassed server validation, disconnecting Splatoon 3 players with communication errors and blocking online play.

- Payout: hidden
- Severity: medium
- Program: Nintendo
- Found by: alzxk11
- Disclosed: 2026-07-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3813932
- Library page: https://bugbountylibrary.com/r/h1%3A3813932
- Tags: area:devices domain:network impact:dos kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:dos

**Target:** NPLN (Nintendo Platform Network) login/message service
**Root cause:** Server-side validation of NplnLogin messages failed to verify the recipient was the sender's own NPLN user ID or a valid Pool target, allowing forged messages to arbitrary users and Pools.
**Steps:**
1. Connect to Splatoon 3 online and observe NplnLogin message sent to own NPLN user ID
2. Craft NplnLogin message targeting another user's NPLN user ID
3. Send forged message; victim disconnects from NPLN with communication error
4. Alternatively target a Pool ID to disconnect all members currently in that Pool
5. Repeat messages rapidly to hit victims during reconnect, preventing online play
**How found:** Researcher noted NplnLogin is normally only sent to one's own NPLN user ID and tested whether server validated the recipient, discovering forged messages to other IDs and Pools were accepted.
**Exploitation:** Attacker sends forged NplnLogin messages to victim user IDs or Pool IDs, forcing disconnection; rapid repetition keeps victims offline by interrupting reconnection.
**Escalation:** Targeting Pools instead of single users scales the disconnect to all members; rapid repetition sustains denial of service.
**Insight:** When a server message is normally self-addressed, test whether the recipient field is validated server-side; Pool/broadcast targets often lack the same checks as per-user targets.