#fixed code
                                @EventHandler(priority = EventPriority.HIGHEST, ignoreCancelled = true)
    public void onSessionRestore(RestoreSessionEvent restoreSessionEvent) {
        Player player = restoreSessionEvent.getPlayer();

        BukkitLoginSession session = plugin.getSession(player.getAddress());
        if (session != null && session.isVerified()) {
            restoreSessionEvent.setCancelled(true);
        }
    }
#vulnerable code 
                                @EventHandler(priority = EventPriority.HIGHEST, ignoreCancelled = true)
    public void onSessionRestore(RestoreSessionEvent restoreSessionEvent) {
        Player player = restoreSessionEvent.getPlayer();

        String id = '/' + player.getAddress().getAddress().getHostAddress() + ':' + player.getAddress().getPort();
        BukkitLoginSession session = plugin.getLoginSessions().get(id);
        if (session != null && session.isVerified()) {
            restoreSessionEvent.setCancelled(true);
        }
    } 
                            #location 5 
                            #vulnerability type NULL_DEREFERENCE