Misskey has a login rate limit bypass via spoofed X-Forwarded-For header
Priority HIGH 70CWE-1188Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-307.
Summary
Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed misskey (misskey-dev): 2025.12.0-alpha.2misskey-js (npm): 2025.12.0-alpha.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| misskey-dev | misskey | 2025.9.1 to before 2025.12.0-alpha.2 | 2025.12.0-alpha.2 | Patch available | CNA |
| — | misskey-js (npm) | 2025.9.1 to before 2025.12.0-alpha.2 | 2025.12.0-alpha.2 | Patch available | GHSA-wwrj-3hvj-prpm |
- misskey Vendormisskey-dev Affected 2025.9.1 to before 2025.12.0-alpha.2 Fixed in 2025.12.0-alpha.2 Patch available CNA
- misskey-js (npm) Vendor— Affected 2025.9.1 to before 2025.12.0-alpha.2 Fixed in 2025.12.0-alpha.2 Patch available GHSA-wwrj-3hvj-prpm
CPE configurations NVD · 37
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* | 13.1.0 to before 2025.12.0 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:-:*:*:*:*:*:* | 13.0.0 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta16:*:*:*:*:*:* | 13.0.0 beta16 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta21:*:*:*:*:*:* | 13.0.0 beta21 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta22:*:*:*:*:*:* | 13.0.0 beta22 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta23:*:*:*:*:*:* | 13.0.0 beta23 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta24:*:*:*:*:*:* | 13.0.0 beta24 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta25:*:*:*:*:*:* | 13.0.0 beta25 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta26:*:*:*:*:*:* | 13.0.0 beta26 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta27:*:*:*:*:*:* | 13.0.0 beta27 | Vulnerable | misskey-dev |
- cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions 13.1.0 to before 2025.12.0 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:-:*:*:*:*:*:* Versions 13.0.0 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta16:*:*:*:*:*:* Versions 13.0.0 beta16 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta21:*:*:*:*:*:* Versions 13.0.0 beta21 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta22:*:*:*:*:*:* Versions 13.0.0 beta22 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta23:*:*:*:*:*:* Versions 13.0.0 beta23 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta24:*:*:*:*:*:* Versions 13.0.0 beta24 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta25:*:*:*:*:*:* Versions 13.0.0 beta25 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta26:*:*:*:*:*:* Versions 13.0.0 beta26 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta27:*:*:*:*:*:* Versions 13.0.0 beta27 Vulnerable ·misskey-dev
Show 27 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:13.0.0:beta28:*:*:*:*:*:* | 13.0.0 beta28 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta29:*:*:*:*:*:* | 13.0.0 beta29 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta30:*:*:*:*:*:* | 13.0.0 beta30 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta31:*:*:*:*:*:* | 13.0.0 beta31 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta32:*:*:*:*:*:* | 13.0.0 beta32 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta33:*:*:*:*:*:* | 13.0.0 beta33 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta34:*:*:*:*:*:* | 13.0.0 beta34 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta35:*:*:*:*:*:* | 13.0.0 beta35 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta36:*:*:*:*:*:* | 13.0.0 beta36 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta37:*:*:*:*:*:* | 13.0.0 beta37 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta38:*:*:*:*:*:* | 13.0.0 beta38 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta39:*:*:*:*:*:* | 13.0.0 beta39 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta40:*:*:*:*:*:* | 13.0.0 beta40 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta41:*:*:*:*:*:* | 13.0.0 beta41 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta42:*:*:*:*:*:* | 13.0.0 beta42 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:beta43:*:*:*:*:*:* | 13.0.0 beta43 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc1:*:*:*:*:*:* | 13.0.0 rc1 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc10:*:*:*:*:*:* | 13.0.0 rc10 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc11:*:*:*:*:*:* | 13.0.0 rc11 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc2:*:*:*:*:*:* | 13.0.0 rc2 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc3:*:*:*:*:*:* | 13.0.0 rc3 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc4:*:*:*:*:*:* | 13.0.0 rc4 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc5:*:*:*:*:*:* | 13.0.0 rc5 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc6:*:*:*:*:*:* | 13.0.0 rc6 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc7:*:*:*:*:*:* | 13.0.0 rc7 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc8:*:*:*:*:*:* | 13.0.0 rc8 | Vulnerable | misskey-dev |
| cpe:2.3:a:misskey:misskey:13.0.0:rc9:*:*:*:*:*:* | 13.0.0 rc9 | Vulnerable | misskey-dev |
- cpe:2.3:a:misskey:misskey:13.0.0:beta28:*:*:*:*:*:* Versions 13.0.0 beta28 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta29:*:*:*:*:*:* Versions 13.0.0 beta29 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta30:*:*:*:*:*:* Versions 13.0.0 beta30 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta31:*:*:*:*:*:* Versions 13.0.0 beta31 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta32:*:*:*:*:*:* Versions 13.0.0 beta32 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta33:*:*:*:*:*:* Versions 13.0.0 beta33 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta34:*:*:*:*:*:* Versions 13.0.0 beta34 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta35:*:*:*:*:*:* Versions 13.0.0 beta35 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta36:*:*:*:*:*:* Versions 13.0.0 beta36 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta37:*:*:*:*:*:* Versions 13.0.0 beta37 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta38:*:*:*:*:*:* Versions 13.0.0 beta38 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta39:*:*:*:*:*:* Versions 13.0.0 beta39 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta40:*:*:*:*:*:* Versions 13.0.0 beta40 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta41:*:*:*:*:*:* Versions 13.0.0 beta41 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta42:*:*:*:*:*:* Versions 13.0.0 beta42 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:beta43:*:*:*:*:*:* Versions 13.0.0 beta43 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc1:*:*:*:*:*:* Versions 13.0.0 rc1 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc10:*:*:*:*:*:* Versions 13.0.0 rc10 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc11:*:*:*:*:*:* Versions 13.0.0 rc11 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc2:*:*:*:*:*:* Versions 13.0.0 rc2 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc3:*:*:*:*:*:* Versions 13.0.0 rc3 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc4:*:*:*:*:*:* Versions 13.0.0 rc4 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc5:*:*:*:*:*:* Versions 13.0.0 rc5 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc6:*:*:*:*:*:* Versions 13.0.0 rc6 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc7:*:*:*:*:*:* Versions 13.0.0 rc7 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc8:*:*:*:*:*:* Versions 13.0.0 rc8 Vulnerable ·misskey-dev
- cpe:2.3:a:misskey:misskey:13.0.0:rc9:*:*:*:*:*:* Versions 13.0.0 rc9 Vulnerable ·misskey-dev
Remediation
- Fix · CNA misskey (misskey-dev) Fixed in 2025.12.0-alpha.2
- Fix · GHSA-wwrj-3hvj-prpm misskey-js (npm) Fixed in 2025.12.0-alpha.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66482
- 2026-10-03 Alias added: GHSA-wwrj-3hvj-prpm
References
More misskey-dev Misskey vulnerabilities
- TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
- TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
- TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
- TI-2025-40839 misskey.js's export data contains private post data CVSS 4.0HIGH 7.1
- TI-2026-22705 Misskey lacks proper authorization checks and input validation CVSS 4.0CRITICAL 9.2
- TI-2025-18960 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes CVSS 3.1CRITICAL 9.3
Sources
- CVE-2025-66482 · CVE Program
- CVE-2025-66482 · NVD
- FIRST EPSS
- GHSA-wwrj-3hvj-prpm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences