UUID spoofing in minecraft

Hi, a few days ago, one of the servers(1.16.4/5) I look after became the target of a "uuid spoofing" attack, two 15-year-old kids got access to administrator privileges, the server was not protected against such attacks, so it did not surprise me at all. I know how to secure it and I am in the process of securing it, but I would like to know what tool they could do it with, whether it's free or paid. I would like to admit that I just want to test some of my servers for security and find out exactly how they did it. The last time I used "uuid spoofer" was around 2014, since then I thought it was secured by the game itself(cheats with this feature seems to be no more updated), but as it turns out "offline" servers are not protected against this attack and are vulnerable.

END OF BACKSTORY (it is for those who would write that it does not work anymore or is secured [yes, on "mojang" servers it is secured but not on "offline"])

What I would like to know:

- Which hacked client / tool supports versions 1.13.2 - 1.16.5

- I am aware that I could have made a mistake as to the method used, so I would like to know what allows you to gain access to permissions / server console (server operating system: windows server 2019)

Thank you very much for any help or tips and have a nice day!