Vickey CVE-2025-61775
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain unexpired confirmation link
-
ExploitReplay link repeatedly
-
ExecutionTrigger repeated confirmation emails
-
ImpactEmail spam to verified address
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V7 - Session Management Session expiration enforcement
|
| Exploitation Conditions | Exploitation requires possession of a confirmation link that has not yet expired for an already-verified email address; the flaw is that such links remain usable after their initial successful confirmation instead of being invalidated. The limiting factor is that the attacker must obtain or control access to a valid confirmation link (e.g., one still sitting in an inbox or intercepted), and the worst-case outcome is bounded to resending confirmation messages to the already-verified address - not account takeover or data access. Only Vickey instances running versions prior to 2025.10.0 are affected. |
| Impact | This is a low-real-risk issue despite a mid-range 6.9 CVSS 4.0 score. The vendor-supplied vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated reach, which inflates the base score, but the actual damage is limited to 'unintended email traffic' with no user-data exposure - a minor abuse/nuisance condition, not a classic integrity or confidentiality breach. The low EPSS score (0.34%, 25th percentile) is consistent with this: there is no KEV listing and no public exploit code, so exploitation probability is low. The CWE (CWE-613, Insufficient Session Expiration) correctly captures the root cause - confirmation links not being invalidated after use. The signals are internally consistent (low EPSS, no KEV, no POC, nuisance-level impact), so this does not warrant priority patching; it is a hygiene fix. Note one conflict to flag: the input VI:L/SI:L (integrity) impact metrics are debatable given the description explicitly states no data is exposed; the only tangible effect is repeated email delivery, which is closer to a minor availability/abuse concern. |
| Exploit ScenarioDerived | An attacker (or an automated script) who obtains or retains a still-valid, previously-used email confirmation link for a verified Vickey account repeatedly re-requests it, causing the platform to resend confirmation emails to the target's verified address. No public exploit code exists; the result is email flooding/nuisance to the recipient rather than account compromise or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Repeated email-confirmation messages in Vickey before 2025.10.0 can be sent to an already-verified address by reusing an unexpired verification link multiple times. The issue is bounded to unintended email traffic and does not expose user data, enable account takeover, or modify account state; exploitation requires possession of a still-valid confirmation link, and only Vickey instances older than 2025.10.0 are affected. No public exploit identified at time of analysis, EPSS is low at 0.34% (25th percentile), and the independent assessment rates it as low real risk despite the supplied 6.9 CVSS 4.0 score; the vendor fixed it in 2025.10.0.
RemediationAI
Upgrade to Vickey 2025.10.0, which is the vendor-released patch; the advisory states that this version improves validation logic so verification links behave as expected after completion. Apply the update per the GitHub advisory at https://github.com/Whimsies-YAT/Vickey/security/advisories/GHSA-q6hp-37x8-fhm7. No other workaround is described in the supplied intelligence; because the issue is low-impact and requires possession of an unexpired link, the main operational action beyond patching is to monitor or rate-limit repeated confirmation email generation if operators observe abuse, understanding that such controls may affect legitimate re-sends.
Affected ProductsAI
Vickey versions prior to 2025.10.0 are affected. Version 2025.10.0 contains the fix. The primary reference is the GitHub security advisory GHSA-q6hp-37x8-fhm7 at https://github.com/Whimsies-YAT/Vickey/security/advisories/GHSA-q6hp-37x8-fhm7. No CPE strings were present in the provided data to enumerate further platform or hosting variants.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vickey is a Misskey-based microblogging platform. The vulnerability sits in the email address confirmation workflow, where a confirmation link or token is intended to prove control of an email address. CWE-613 (Insufficient Session Expiration) describes the root cause: after a link completes confirmation, it is not invalidated or marked as consumed, so it remains usable until its natural expiration. Under affected versions prior to 2025.10.0, repeated access to that link can repeatedly trigger confirmation emails to an already-verified address. The supplied CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with limited integrity and availability impact, but the independent assessment uses CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L and emphasizes that the practical precondition is possession of a valid, unexpired confirmation link; the flaw is not remotely exploitable to read data or take over accounts.
Know when Misskey gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
Remote low-complexity link replay with no auth (AV:N/AC:L/PR:N/UI:N); no confidentiality or integrity change, only minor email-traffic/abuse impact, hence C:N/I:N/A:L.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address could receive repeated confirmation messages if the verification link was accessed multiple times. This issue may result in unintended email traffic but does not expose user data. The issue was addressed in version 2025.10.0 by improving validation logic to ensure verification links behave as expected after completion.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Misskey is an open source, decentralized microblogging platform. Rated high severity (CVSS 7.5), this vulnerability is r
Missing authorization checks in Misskey's favorites and clips export feature allow any authenticated user to read the co
Login rate-limit bypass in Misskey (versions 2025.9.1 through 2025.11.x, and up to but not including 2025.12.0-alpha.2)
Misskey before 10.102.4 allows hijacking a user's token. Rated medium severity (CVSS 6.1), this vulnerability is remotel
Misskey is an open source, decentralized social media platform. Rated critical severity (CVSS 9.8), this vulnerability i
Misskey is an open source, decentralized social media platform. Rated critical severity (CVSS 9.6), this vulnerability i
Misskey is an open source, federated social media platform. Rated medium severity (CVSS 5.4), this vulnerability is remo
Signature validation bypass in Misskey (versions 12.37.0 through prior to 2026.5.4) allows an attacker to have spoofed A
JSON-LD signature validation in Misskey's ActivityPub federation layer accepts fraudulent federated activities due to a
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.8), this vulnerability is remote
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.8), this vulnerability is remote
Misskey is an open source, decentralized social media platform with ActivityPub support. Rated high severity (CVSS 8.8),
Exploit-DB