CVE-2025-66482
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Misskey is an open source, federated social media platform. Attackers using an untrusted reverse proxy or no reverse proxy can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (trustProxy) was added to prevent this, but it has an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if not configured correctly. The fix in v2025.12.0-alpha.2 flips the default value of trustProxy to false.
Risk Assessment
The risk is the possibility of bypassing IP rate limits, which could enable brute-force attacks or spam.
Recommendation
It is recommended to update Misskey to v2025.12.0-alpha.2 or later. If updating is not possible, manually set trustProxy: false in the config file.
Other vulnerabilities in Misskey
See all- CVE-2026-46713Critical
Misskey, an open source federated social media platform, has a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid.
- CVE-2026-104817High
Misskey, a social media platform, has a vulnerability in the unauthenticated fetch-rss API that lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
- CVE-2026-104816High
Misskey has a vulnerability in RSS components that display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
- CVE-2026-103937High
Misskey has a vulnerability where cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.
- CVE-2026-48115Medium
Misskey versions from 2024.5.0 up to 2026.5.4 (pre-patch) contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data they normally couldn't view. This vulnerability occurs whether or not federation is enabled.
- CVE-2026-47746High
Misskey, an open-source federated social media platform, versions 12.37.0 through 2026.5.4, is vulnerable to timing attacks during JSON-LD signature validation and compaction. Lack of shared JSON-LD parsing context between signature verification and processing leads to a TOCTOU flaw, allowing an attacker to have fraudulent activities accepted as valid. Fixed in version 2026.5.4.
- CVE-2026-46714Medium
Misskey versions from 8.63.0 up to 2026.5.4 (pre-patch) contain a vulnerability that can cause the web client to slow down or crash when it applies a malformed theme.
- CVE-2026-46712Low
Misskey versions 2025.3.2 up to (but not including) 2026.5.4 have a missing permission check that allows access to certain Direct Messages data regardless of account permissions. Notes with 'specified' visibility are not affected. Fixed in version 2026.5.4.
- CVE-2026-57575Medium
Misskey prior to version 2026.6.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL preview functionality. Missing network restrictions before establishing outbound connections allow a remote attacker to send HTTP requests to loopback, private, or link-local services.
- CVE-2026-57574High
Misskey prior to version 2026.6.0 contains a vulnerability in TOTP authentication where insufficient validation of used tokens allows reuse of a single-use code within its valid time step. An attacker who obtains both credentials and a TOTP code can reuse it for unauthorized actions, potentially leading to account takeover.
Original NVD description (English source)
Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS