CVE-2025-24897: Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-11 · updated 2026-06-17
Weakness: CWE-352

Description

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).

Affected products

misskey-dev misskey: from 12.109.0 before 2025.2.0 — fixed in 2025.2.0

How to fix

Upgrade to a fixed version: misskey-dev misskey 2025.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-24897 or the next vulnerability affects your stack