Read the docs
TI-2023-23496 Aliases CVE-2023-43805

Nexkey allows users to bypass authentication of Bull dashboard

Priority MEDIUM 40CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00795 56th percentileScored 2026-11-07
Fix Fixed nexkey (nexryai): 12.121.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nexryainexkeybefore 12.121.912.121.9Patch availableCNA
  • nexkey Vendornexryai Affected before 12.121.9 Fixed in 12.121.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:node.js:*:*before 12.121.9Vulnerablenexryai
  • cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:node.js:*:* Versions before 12.121.9 Vulnerable ·nexryai

Remediation

  • Fix · CNA nexkey (nexryai) Fixed in 12.121.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-43805
  2. 2026-10-05 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2023-26760 nexkey allows arbitrary users to impersonate any remote user due to missing signature validation CVSS 3.1HIGH 8.6
  • TI-2023-28521 External apps using tokens issued by administrators and moderators can call admin APIs CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences