Misskey: TOTP tokens can be reused
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-294.
Summary
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| misskey-dev | misskey | before 2026.6.0 | 2026.6.0 | Patch available | CNA |
- misskey Vendormisskey-dev Affected before 2026.6.0 Fixed in 2026.6.0 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* | — | — | misskey-dev |
- cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions — — ·misskey-dev
Remediation
- Fix · CNA misskey (misskey-dev) Fixed in 2026.6.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-57574
References
Other 4
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m5x-5mp6-6vpq
- https://github.com/misskey-dev/misskey/commit/00c6210a591db2b0be438740d05b82070fa68ac6
- https://github.com/misskey-dev/misskey/commit/d323fe00d04ac46ab0b4e66fce9169effaa8dfb7
- https://github.com/misskey-dev/misskey/releases/tag/2026.6.0
More misskey-dev vulnerabilities
- TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
- TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
- TI-2025-40906 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
- TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
- TI-2025-40839 misskey.js's export data contains private post data CVSS 4.0HIGH 7.1
- TI-2025-29271 @misskey-dev/summaly Redirect Filter Bypass CVSS 4.0LOW 2.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences