CVE-2026-57574
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Misskey prior to version 2026.6.0 contains a vulnerability in TOTP authentication where insufficient validation of used tokens allows reuse of a single-use code within its valid time step. An attacker who obtains both credentials and a TOTP code can reuse it for unauthorized actions, potentially leading to account takeover.
Risk Assessment
The risk is that an attacker who gains access to login credentials and a TOTP code can take over a user account, leading to data theft, privacy breaches, or privilege escalation within the federated social media platform.
Recommendation
Immediately upgrade Misskey to version 2026.6.0 or later, which fixes the issue by preventing TOTP code reuse.
Other vulnerabilities in Misskey
See all- CVE-2026-46713Critical
Misskey, an open source federated social media platform, has a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid.
- CVE-2026-48115Medium
Misskey versions from 2024.5.0 up to 2026.5.4 (pre-patch) contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data they normally couldn't view. This vulnerability occurs whether or not federation is enabled.
- CVE-2026-47746High
Misskey, an open-source federated social media platform, versions 12.37.0 through 2026.5.4, is vulnerable to timing attacks during JSON-LD signature validation and compaction. Lack of shared JSON-LD parsing context between signature verification and processing leads to a TOCTOU flaw, allowing an attacker to have fraudulent activities accepted as valid. Fixed in version 2026.5.4.
- CVE-2026-46714Medium
Misskey versions from 8.63.0 up to 2026.5.4 (pre-patch) contain a vulnerability that can cause the web client to slow down or crash when it applies a malformed theme.
- CVE-2026-46712Low
Misskey versions 2025.3.2 up to (but not including) 2026.5.4 have a missing permission check that allows access to certain Direct Messages data regardless of account permissions. Notes with 'specified' visibility are not affected. Fixed in version 2026.5.4.
- CVE-2026-57575Medium
Misskey prior to version 2026.6.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL preview functionality. Missing network restrictions before establishing outbound connections allow a remote attacker to send HTTP requests to loopback, private, or link-local services.
Original NVD description (English source)
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.