Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-25306

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `url` field even if the specific ActivityPub object type require authority in the `id` field. Version 2025.2.1 addresses the issue.

Published

2025-03-10T19:15:40.230

Last Modified

2025-11-26T16:24:21.260

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.3 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-346
    CWE-441
    CWE-1025
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application misskey misskey < 2025.2.1 Yes
References