Missing validation allows spoofed profiles in Misskey
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to impersonate existing users from the target instance. Vulnerable Misskey instances will accept spoofed users as valid, allowing an attacker to impersonate users on another instance. Attackers have full control of the spoofed user and can post, renote, or otherwise interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| misskey-dev | misskey | 2024.8.0-rc.3 to before 2024.11.0-alpha.3 | 2024.11.0-alpha.3 | Patch available | CNA |
- misskey Vendormisskey-dev Affected 2024.8.0-rc.3 to before 2024.11.0-alpha.3 Fixed in 2024.11.0-alpha.3 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* | after 2024.8.0, before 2024.11.0 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:2024.8.0:rc3:*:*:*:*:*:* | 2024.8.0 rc3 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:2024.8.0:rc4:*:*:*:*:*:* | 2024.8.0 rc4 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:2024.8.0:rc5:*:*:*:*:*:* | 2024.8.0 rc5 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:2024.11.0:alpha0:*:*:*:*:*:* | 2024.11.0 alpha0 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:2024.11.0:alpha1:*:*:*:*:*:* | 2024.11.0 alpha1 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:2024.11.0:alpha2:*:*:*:*:*:* | 2024.11.0 alpha2 | Vulnerable | misskey-dev |
- cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions after 2024.8.0, before 2024.11.0 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:2024.8.0:rc3:*:*:*:*:*:* Versions 2024.8.0 rc3 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:2024.8.0:rc4:*:*:*:*:*:* Versions 2024.8.0 rc4 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:2024.8.0:rc5:*:*:*:*:*:* Versions 2024.8.0 rc5 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:2024.11.0:alpha0:*:*:*:*:*:* Versions 2024.11.0 alpha0 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:2024.11.0:alpha1:*:*:*:*:*:* Versions 2024.11.0 alpha1 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:2024.11.0:alpha2:*:*:*:*:*:* Versions 2024.11.0 alpha2 Vulnerable ·misskey-dev
Remediation
- Fix · CNA misskey (misskey-dev) Fixed in 2024.11.0-alpha.3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-52590
References
More misskey-dev Misskey vulnerabilities
- TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
- TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
- TI-2025-40906 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
- TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
- TI-2025-40839 misskey.js's export data contains private post data CVSS 4.0HIGH 7.1
- TI-2026-22705 Misskey lacks proper authorization checks and input validation CVSS 4.0CRITICAL 9.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences