What’s Vulnerable › Vulnerabilities

CVE-2024-32983: Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-03 · updated 2026-06-17
• Weakness: CWE-863

Description

Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.

Affected products

• misskey-dev misskey: before 2024.5.0 — fixed in 2024.5.0

How to fix

Upgrade to a fixed version: misskey-dev misskey 2024.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj
• https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj

Get alerted when CVE-2024-32983 or the next vulnerability affects your stack