Misskey CVE-2025-66482

Exploitable only on Misskey instances (versions 2025.9.1 up to but not including 2025.12.0-alpha.2) that are run WITHOUT a trusted reverse proxy - or behind an untrusted one - while the trustProxy config option remains at its insecure default value of true. Under those conditions an attacker spoofs the X-Forwarded-For header on requests to the /api/signin-flow login endpoint to evade per-IP rate limiting. LIMITING FACTORS: instances correctly fronted by a trusted reverse proxy are not affected; operators on 2025.9.1-2025.11.1 can fully mitigate by setting trustProxy:false in the config file; upgrading to 2025.12.0-alpha.2+ makes trustProxy:false the default. No authentication or user interaction is required to send the forged header, but impact is limited to defeating rate limiting (enabling credential brute-force), not direct authentication bypass.

Multiple signals converge on a moderate, config-dependent priority rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:L/VA:L, score 6.9 Medium) indicates a remote, unauthenticated, low-complexity attack with only limited integrity/availability impact and no confidentiality impact - consistent with a rate-limiting bypass (CWE-307) rather than direct code execution or data disclosure. A public exploit exists: the GHSA advisory includes a working PoC against the /api/signin-flow endpoint, so 'publicly available exploit code exists.' However, this is NOT in CISA KEV and there is no evidence of active exploitation, so it should be treated as POC-available, not actively weaponized - these are distinct signals. No EPSS score was provided, so widespread-exploitation probability cannot be quantified from this data. The key mitigating factor is that real-world impact is gated entirely by deployment: instances fronted by a correctly trusted reverse proxy are not affected, and the harm is enabling credential brute-force (facilitating, not directly performing, account compromise). Net: a legitimate issue to patch promptly for exposed/misconfigured instances, but its network-unauthenticated CVSS slightly overstates universal risk because exploitability depends on the proxy/trustProxy configuration.

An attacker targets a Misskey instance that has no reverse proxy (or an untrusted one) and whose trustProxy setting is at the insecure pre-2025.12.0-alpha.2 default of true. Because a public PoC exists, the attacker sends repeated POST requests to /api/signin-flow, each carrying a forged X-Forwarded-For header with a rotating IP, defeating the per-IP login rate limiter. This lets them brute-force account passwords (including 'admin') without being throttled, since the attack is network-based, unauthenticated, and low-complexity.