CVE-2025-25306

Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

State: Published
Severity: 9.3 Critical
Published: Mar 10, 2025
Updated: Mar 12, 2025
Reserved: Feb 6, 2025

Description

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `url` field even if the specific ActivityPub object type require authority in the `id` field. Version 2025.2.1 addresses the issue.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N	GitHub_M

Weaknesses

CWE-346 Origin Validation Error
CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
CWE-1025 Comparison Using Wrong Factors

Affected Products

Product	Versions
misskeymisskey-dev	< 2025.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.