Which versions of Misskey are affected by CVE-2026-57574?

Misskey's authentication service fails to invalidate TOTP codes after first use, allowing attackers who capture a user's password and one authentication code to replay that code for account access-a…. A patch is available.

How to fix or mitigate CVE-2026-57574?

Within 24 hours: audit all Misskey deployments to identify versions and assess exposure. Within 7 days: upgrade all instances to Misskey 2026.6.0 or later. Within 30 days: verify deployment completion and conduct validation testing of TOTP code invalidation.

Misskey CVE-2026-57574

Q: What is the CVSS score of CVE-2026-57574?

CVE-2026-57574 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43041 HIGH

Authentication Bypass by Capture-replay (CWE-294)

2026-07-10 GitHub_M

Authentication Bypass Misskey Misskey Dev

7.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network replay against the login endpoint (AV:N, PR:N) but success requires concurrently capturing password and a live TOTP within one time step (AC:H) and relies on the victim's active authentication (UI:R); takeover yields C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 22:02 EUVD

Analysis Generated

Jul 10, 2026 - 21:43 vuln.today

DescriptionCVE.org

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.

AnalysisAI

Authentication replay in Misskey before 2026.6.0 lets an attacker reuse a valid TOTP code that should be single-use, because UserAuthService fails to invalidate a code after its first successful use within the same time step. An adversary who concurrently captures a victim's password and one TOTP value can replay that code to authenticate, enabling unauthorized actions up to account takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the vendor fixed the flaw in release 2026.6.0.

Technical ContextAI

Misskey is an open-source, ActivePub-federated social media platform (fediverse) written primarily in TypeScript/Node.js. The flaw sits in its second-factor authentication path (UserAuthService), which validates Time-based One-Time Passwords (TOTP, RFC 6238). Correct TOTP implementations must mark a code as consumed after a successful verification so it cannot be accepted again during the ~30-second window in which it remains cryptographically valid. Here that used-token tracking is insufficient, so the same 6-digit code passes verification more than once. This maps to CWE-294 (Authentication Bypass by Capture-Replay): the security property being violated is single-use enforcement, not the OTP cryptography itself. The affected component is identified by CPE cpe:2.3:a:misskey-dev:misskey:*:*:*:*:*:*:*:* covering all versions prior to the patched 2026.6.0.

RemediationAI

Vendor-released patch: upgrade to Misskey 2026.6.0, which enforces single-use TOTP validation in UserAuthService; the fix corresponds to commits 00c6210a591db2b0be438740d05b82070fa68ac6 and d323fe00d04ac46ab0b4e66fce9169effaa8dfb7. Consult the advisory at https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m5x-5mp6-6vpq and deploy from https://github.com/misskey-dev/misskey/releases/tag/2026.6.0. If an immediate upgrade is not possible, reduce the concurrent-capture window by encouraging or enforcing credential resets and, where supported, prefer FIDO2/WebAuthn passkeys over TOTP for privileged accounts since replay does not apply to challenge-response hardware factors; also monitor authentication logs for repeated use of the same OTP value or multiple logins from one code as a detection compensating control. These controls narrow but do not eliminate the replay window, so patching remains the definitive fix.