misskey up to 2025.9.1/2025.11.1/2025.12.0-alpha.1 Header X-Forwarded-For excessive authentication

Summaryinfo

A vulnerability labeled as problematic has been found in misskey up to 2025.9.1/2025.11.1/2025.12.0-alpha.1. The affected element is an unknown function of the component Header Handler. Such manipulation of the argument X-Forwarded-For leads to excessive authentication. This vulnerability is traded as CVE-2025-66482. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in misskey up to 2025.9.1/2025.11.1/2025.12.0-alpha.1. Affected by this issue is an unknown part of the component Header Handler. The manipulation of the argument X-Forwarded-For with an unknown input leads to a excessive authentication vulnerability. Using CWE to declare the problem leads to CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-66482 since 12/02/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1110.001.

Upgrading to version 2025.12.0-alpha.2 eliminates this vulnerability. Applying the patch 5512898463fa8487b9e6488912f35102b91f25f7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• misskey

Version

• 2025.9.0
• 2025.9.1
• 2025.11.0
• 2025.11.1
• 2025.12.0-alpha.0
• 2025.12.0-alpha.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion