CVE-2023-24810: Cross site scripting (XSS) vulnerability using authentication callback in Misskey

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-22 · updated 2026-06-17
Weakness: CWE-79

Description

Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentication in Misskey, arbitrary JavaScript can be executed when a user allows the link. All versions below 13.3.1 (including 12.x) are affected. This has been fixed in version 13.3.1. Users are advised to upgrade. Users unable to upgrade should not allow authentication of untrusted apps.

Affected products

misskey-dev misskey: before 13.3.1 — fixed in 13.3.1

How to fix

Upgrade to a fixed version: misskey-dev misskey 13.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24810 or the next vulnerability affects your stack