The use of getPlayer() in BungeePlayer is unsound. It is possible for getPlayer() to return null, but the code in BungeePlayer does not account for this.

For example:

It does not matter whether the caller checks any preconditions (such as isOnline()). The code would still be vulnerable to a race condition. Take the following situation:

1. Caller checks BungeePlayer#isOnline; isOnline() returns true
2. The player represented by BungeePlayer disconnects from the proxy
3. Caller calls BungeePlayer#hasPermission
4. A NPE is thrown