Insecure Default Initialization of Resource in Misskey - CVE-2025-66482

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass login rate limiting and brute force accounts.

The vulnerability exists due to initialization of a resource with an insecure default in the SigninApiService login rate limiting logic when handling login requests with a forged X-Forwarded-For header. A remote attacker can send crafted authentication requests with a spoofed X-Forwarded-For header to bypass login rate limiting and brute force accounts.

The issue is exposed when the instance is using an untrusted reverse proxy or no reverse proxy.

How to mitigate CVE-2025-66482

Sources

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm
• https://github.com/advisories/GHSA-wwrj-3hvj-prpm