What’s Vulnerable › Vulnerabilities

CVE-2019-1020010

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-29 · updated 2026-06-17
• Weakness: CWE-79

Description

Misskey before 10.102.4 allows hijacking a user's token.

Affected products

• misskey-dev misskey: from 10.46.0 before 10.102.4; from 11.0.0 before 11.20.2; 11.0.0-alpha1, 11.0.0-alpha10, 11.0.0-alpha2, 11.0.0-alpha3, 11.0.0-alpha4, 11.0.0-alpha5 (+19) — fixed in 10.102.4, 11.20.2

How to fix

Upgrade to a fixed version: misskey-dev misskey 10.102.4, 11.20.2. Check the vendor advisory for mitigations.

References

• https://github.com/syuilo/misskey/security/advisories/GHSA-6qw9-6jxq-xj3p
• https://github.com/syuilo/misskey/security/advisories/GHSA-6qw9-6jxq-xj3p

Get alerted when CVE-2019-1020010 or the next vulnerability affects your stack