PT-2025-10614 · Misskey · Misskey

Eternal-Flame-Ad · Published 2025-03-10 · Updated 2025-03-10 · CVE-2025-25306

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 2025.2.1

Description The issue concerns the validation of the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub object type requires authority in the id field.

Recommendations For versions prior to 2025.2.1, update to version 2025.2.1 to resolve the issue. As a temporary workaround, consider restricting the use of ActivityPub objects that require authority in the id field until the patch is applied. Avoid using the url field in ActivityPub objects to claim authority if the object type requires authority in the id field.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-1025

CWE-346

CWE-441

Related Identifiers

CVE-2025-25306

GHSA-6W2C-VF6F-XF26

Affected Products

Misskey

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25306.json · Exploit
• https://github.com/misskey-dev/misskey/releases/tag/2025.2.1 · Patch
• https://osv.dev/vulnerability/CVE-2025-25306 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25306 · Security Note
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-6w2c-vf6f-xf26 · Note
• https://twitter.com/CVEnew/status/1899169584067891367 · Twitter Post
• https://t.me/cvetracker/18838 · Telegram Post
• https://twitter.com/CveFindCom/status/1899166392596693477 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1899232259510595877 · Twitter Post
• https://t.me/cvedetector/19994 · Telegram Post