Origin validation error in Misskey - CVE-2025-25306
Published: March 31, 2025
Vulnerability identifier: #VU106268
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-25306
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incomplete patch on CVE-2024-52591 (SB2025033119). A remote attacker can forge an object where they claim authority in the url field even if the specific ActivityPub object type require authority in the id field.
Affected software
Misskey
How to mitigate CVE-2025-25306
Install updates from vendor's website.
Misskey - update to 2025.2.1