Misskey EUVD-2026-43041

Exploitation requires the attacker to obtain the victim's password AND a valid TOTP code for the same account concurrently (e.g., via phishing, a reverse-proxy AitM kit, or interception), then replay that code within its single valid TOTP time step (~30 seconds) before it naturally expires. The vulnerability only affects accounts that have TOTP two-factor authentication enabled on Misskey instances running a version prior to 2026.6.0. Limiting factors: the attacker cannot succeed with credentials alone or a code alone - both must be captured together and used within the short window (CVSS AC:H, AT:P, UI:A), making this suited to targeted or real-time AitM attacks rather than broad automated exploitation; accounts not using TOTP, or instances already on 2026.6.0, are not exploitable via this flaw.

The vendor CVSS 4.0 base score is 7.4 (High) with vector AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N, and the signals are internally consistent with a real but conditional threat. Network reachability (AV:N) and no required attacker privileges (PR:N) raise exposure, but High attack complexity (AC:H), a Present attack requirement (AT:P), and Active user interaction (UI:A) all reflect that success depends on the attacker first obtaining both the victim's credentials and a live TOTP code in the same short window - a meaningful barrier that pushes this toward opportunistic/targeted use rather than mass exploitation. Impact is credible: high confidentiality and integrity (VC:H/VI:H) with no availability impact (VA:N), consistent with account takeover. No EPSS score, KEV listing, or POC was provided in the intelligence, so exploitation-probability data is missing rather than low - the score reflects a real 2FA weakening, not a high-CVSS-but-trivial issue, but the replay-only nature and the requirement to already hold the password materially cap real-world urgency compared to a pre-auth RCE.

An attacker who has phished or intercepted a Misskey user's username, password, and the TOTP code they just entered (for example via a man-in-the-middle proxy or a malicious login page) replays that same still-valid 6-digit code against the login endpoint before the ~30-second time step expires. Because the code was not invalidated on first use, the second authentication succeeds and the attacker gains an authenticated session, enabling account takeover. No public POC was provided, and the High attack complexity reflects the need to capture both factors concurrently.