Even when white-list=true is set in server.properties, players who are not added to the whitelist can still join the server as usual. This bypasses the intended access control.
Steps to Reproduce:
Set white-list=true in the server.properties file.
Start the Bedrock Dedicated Server.
Attempt to join the server using an account that is not on the whitelist.json list.
The account successfully joins the server instead of being kicked.
Observed Results:
Players not on the whitelist can join the server without any restrictions.
Expected Results:
Players not on the whitelist should be disconnected with a message stating they are not whitelisted.
This issue should be fixed as of 26.12 Hotfix. Please make sure you have downloaded the latest Bedrock Server version here:
https://www.minecraft.net/bedrockdedicatedserver/bin-win/bedrock-server-1.26.14.1.zip