# UNDF: UNDF-2026-000000959
--- a/source/lobby/XmppClient.cpp
+++ b/source/lobby/XmppClient.cpp
@@ -1,5 +1,6 @@
 // CWE-312 (MOAD-0004): Lobby auth tokens logged verbatim, exposing session
 // credentials in log files. Fix: redact token values in log output.

@@ -958,7 +959,7 @@
-			LOGMESSAGE("XmppClient: Received lobby auth: %s from %s", lobbyAuth->m_Token.to_string(), iq.from().username());
+			LOGMESSAGE("XmppClient: Received lobby auth: [REDACTED] from %s", iq.from().username());

--- a/source/network/NetServer.cpp
+++ b/source/network/NetServer.cpp
@@ -874,7 +874,7 @@
-	LOGMESSAGE("Net Server: Received lobby auth message from %s with %s", name, token);
+	LOGMESSAGE("Net Server: Received lobby auth message from %s with [REDACTED]", name);