Misskey
Monthly
JSON-LD signature validation in Misskey's ActivityPub federation layer accepts fraudulent federated activities due to a TOCTOU flaw where the JSON-LD parsing context used during signature verification is not shared with the context used during subsequent message processing. Affected are all self-hosted Misskey instances running versions 12.37.0 through 2026.5.3. A remote, unauthenticated attacker operating or spoofing a federated server can craft payloads that pass signature checks yet resolve to malicious content during processing, resulting in high integrity impact across the instance and potentially propagating to federated peers; no public exploit or CISA KEV listing has been identified at time of analysis.
Signature validation bypass in Misskey (versions 12.37.0 through prior to 2026.5.4) allows an attacker to have spoofed ActivityPub activities accepted as authentic. The flaw resides in the JSON-LD signature validation and compaction logic (CWE-347), enabling forgery of federated actions such as posts or actions attributed to other actors/instances. The CVSS 4.0 base score is 9.2 (Critical) with a network, unauthenticated, low-complexity vector emphasizing integrity impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication replay in Misskey before 2026.6.0 lets an attacker reuse a valid TOTP code that should be single-use, because UserAuthService fails to invalidate a code after its first successful use within the same time step. An adversary who concurrently captures a victim's password and one TOTP value can replay that code to authenticate, enabling unauthorized actions up to account takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the vendor fixed the flaw in release 2026.6.0.
federated social media platform. All Misskey server versions up to 2026.3.1 is affected by improper verification of cryptographic signature.
Misskey is an open source, federated social media platform.
Malformed theme application in the Misskey web client (versions 8.63.0 through pre-2026.5.4) triggers uncontrolled recursion (CWE-674), causing the browser client to slow down significantly or crash entirely. Unauthenticated network-reachable attackers can craft and distribute a malicious theme that, when applied by a victim user, produces a client-side denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; active exploitation is not confirmed.
Insufficient permission checks in Misskey's Direct Messages (Chat) feature expose DM data points to authenticated users who lack authorization to access them, across versions 2025.3.2 through 2026.5.3. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the server fails to validate account permissions before returning DM-related data via API. No public exploit or CISA KEV listing exists; the vendor patched this in version 2026.5.4 alongside four additional CVEs.
Unauthorized data disclosure via the Server Announcements API in Misskey affects all instances running versions 2024.5.0 through 2026.5.3, allowing remote callers to read restricted announcement data without appropriate authorization. The flaw stems from CWE-285 (Improper Authorization) - the API endpoint fails to enforce privilege checks before returning data, making restricted content accessible to actors who should not see it. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, no-authentication-required vector makes this straightforwardly reachable on any exposed instance.
Server-Side Request Forgery in Misskey's UrlPreviewService allows remote unauthenticated attackers to coerce the platform's backend into initiating outbound HTTP connections toward loopback addresses, RFC-1918 private ranges, and link-local networks. The root cause is that IP address validation is applied only after the TCP connection has already been established, meaning the outbound request reaches the internal target before the check rejects it. Per vendor disclosure, response data is not believed to be returned to the attacker, limiting the impact to blind SSRF with potential for triggering internal service side effects. No public exploit identified at time of analysis, and a fix is available in version 2026.6.0.
Misskey versions 10.93.0 through 2026.3.0 allow authenticated users to import arbitrary user data due to insufficient ownership validation, enabling attackers with knowledge of target file IDs to access other users' information. The vulnerability requires valid login credentials and knowledge of specific file identifiers, limiting its practical impact. No patch is currently available.
Misskey is an open source, federated social media platform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable. Public exploit code available.
@misskey-dev/summaly is a tool for getting a summary of a web page. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, federated social media platform. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, federated social media platform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Misskey is an open source, decentralized microblogging platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Misskey is an open source, decentralized social media platform with ActivityPub support. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
Misskey is an open source, decentralized social media platform. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity.
Misskey is an open source, decentralized social media platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, decentralized social media platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Misskey is an open source, decentralized social media platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Misskey is an open source, decentralized social media platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Misskey is an open source, decentralized social media platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, decentralized social media platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, decentralized microblogging platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Misskey is a decentralized microblogging platform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Misskey before 10.102.4 allows hijacking a user's token. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JSON-LD signature validation in Misskey's ActivityPub federation layer accepts fraudulent federated activities due to a TOCTOU flaw where the JSON-LD parsing context used during signature verification is not shared with the context used during subsequent message processing. Affected are all self-hosted Misskey instances running versions 12.37.0 through 2026.5.3. A remote, unauthenticated attacker operating or spoofing a federated server can craft payloads that pass signature checks yet resolve to malicious content during processing, resulting in high integrity impact across the instance and potentially propagating to federated peers; no public exploit or CISA KEV listing has been identified at time of analysis.
Signature validation bypass in Misskey (versions 12.37.0 through prior to 2026.5.4) allows an attacker to have spoofed ActivityPub activities accepted as authentic. The flaw resides in the JSON-LD signature validation and compaction logic (CWE-347), enabling forgery of federated actions such as posts or actions attributed to other actors/instances. The CVSS 4.0 base score is 9.2 (Critical) with a network, unauthenticated, low-complexity vector emphasizing integrity impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication replay in Misskey before 2026.6.0 lets an attacker reuse a valid TOTP code that should be single-use, because UserAuthService fails to invalidate a code after its first successful use within the same time step. An adversary who concurrently captures a victim's password and one TOTP value can replay that code to authenticate, enabling unauthorized actions up to account takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the vendor fixed the flaw in release 2026.6.0.
federated social media platform. All Misskey server versions up to 2026.3.1 is affected by improper verification of cryptographic signature.
Misskey is an open source, federated social media platform.
Malformed theme application in the Misskey web client (versions 8.63.0 through pre-2026.5.4) triggers uncontrolled recursion (CWE-674), causing the browser client to slow down significantly or crash entirely. Unauthenticated network-reachable attackers can craft and distribute a malicious theme that, when applied by a victim user, produces a client-side denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; active exploitation is not confirmed.
Insufficient permission checks in Misskey's Direct Messages (Chat) feature expose DM data points to authenticated users who lack authorization to access them, across versions 2025.3.2 through 2026.5.3. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the server fails to validate account permissions before returning DM-related data via API. No public exploit or CISA KEV listing exists; the vendor patched this in version 2026.5.4 alongside four additional CVEs.
Unauthorized data disclosure via the Server Announcements API in Misskey affects all instances running versions 2024.5.0 through 2026.5.3, allowing remote callers to read restricted announcement data without appropriate authorization. The flaw stems from CWE-285 (Improper Authorization) - the API endpoint fails to enforce privilege checks before returning data, making restricted content accessible to actors who should not see it. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, no-authentication-required vector makes this straightforwardly reachable on any exposed instance.
Server-Side Request Forgery in Misskey's UrlPreviewService allows remote unauthenticated attackers to coerce the platform's backend into initiating outbound HTTP connections toward loopback addresses, RFC-1918 private ranges, and link-local networks. The root cause is that IP address validation is applied only after the TCP connection has already been established, meaning the outbound request reaches the internal target before the check rejects it. Per vendor disclosure, response data is not believed to be returned to the attacker, limiting the impact to blind SSRF with potential for triggering internal service side effects. No public exploit identified at time of analysis, and a fix is available in version 2026.6.0.
Misskey versions 10.93.0 through 2026.3.0 allow authenticated users to import arbitrary user data due to insufficient ownership validation, enabling attackers with knowledge of target file IDs to access other users' information. The vulnerability requires valid login credentials and knowledge of specific file identifiers, limiting its practical impact. No patch is currently available.
Misskey is an open source, federated social media platform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable. Public exploit code available.
@misskey-dev/summaly is a tool for getting a summary of a web page. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, federated social media platform. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, federated social media platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, federated social media platform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Misskey is an open source, decentralized microblogging platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Misskey is an open source, decentralized social media platform with ActivityPub support. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
Misskey is an open source, decentralized social media platform. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity.
Misskey is an open source, decentralized social media platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, decentralized social media platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Misskey is an open source, decentralized social media platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Misskey is an open source, decentralized social media platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Misskey is an open source, decentralized social media platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, decentralized social media platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Misskey is an open source, decentralized microblogging platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Misskey is a decentralized microblogging platform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Misskey before 10.102.4 allows hijacking a user's token. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.