PT-2025-6243 · Misskey · Misskey

Hoto-Cocoa + 1 · Published 2025-02-11 · Updated 2025-02-20 · CVE-2025-24896

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.109.0 through 2025.2.0-alpha.0

Description: Misskey is an open source, federated social media platform. A login token named token is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary affected users will be users who have logged into Misskey using a public PC or someone else's device, but it's possible that users who have logged out of Misskey before lending their PC to someone else could also be affected.

Recommendations: For versions 12.109.0 through 2025.2.0-alpha.0, update to version 2025.2.0-alpha.0 or later to resolve the issue. As a temporary workaround, consider clearing cookies after logging out of Misskey to minimize the risk of exploitation. Restrict access to sensitive information on shared devices to prevent potential misuse of the undeleted login token.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-24896

GHSA-W98M-J6HQ-CWJM

Affected Products

Misskey

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24896.json · Exploit
• https://github.com/misskey-dev/misskey/commit/ba9f295ef2bf31cc90fa587e20b9a7655b7a1824 · Patch
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-w98m-j6hq-cwjm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24896 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24896 · Vendor Advisory
• https://twitter.com/CVEnew/status/1889336908779602207 · Twitter Post
• https://t.me/cvenotify/111882 · Telegram Post