PT-2025-41796 · Vickey · Vickey

Published 2025-10-13 · Updated 2025-10-13 · CVE-2025-61775

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Vickey versions prior to 2025.10.0

Description Vickey, a Misskey-based microblogging platform, has an issue where unexpired email confirmation links can be reused multiple times, leading to repeated confirmation emails being sent to a verified email address. This can occur if the verification link is accessed multiple times under certain conditions. The issue results in unintended email traffic but does not expose user data.

Recommendations Update to version 2025.10.0 or later.

Exploit

Fix

Insufficient Session Expiration

Allocation of Resources Without Limits

Weakness Enumeration

CWE-613

CWE-770

Related Identifiers

CVE-2025-61775

GHSA-Q6HP-37X8-FHM7

Affected Products

Vickey

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61775.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-61775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61775 · Security Note
• https://github.com/Whimsies-YAT/Vickey/security/advisories/GHSA-q6hp-37x8-fhm7 · Note
• https://t.me/CVEtracker/34784 · Telegram Post
• https://t.me/cveNotify/138458 · Telegram Post
• https://twitter.com/CVEnew/status/1977791995989914102 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1977808257981792660 · Twitter Post