CVE-2025-66482

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66482
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66482.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66482
Aliases
Published
2025-12-15T23:18:37Z
Modified
2026-08-12T03:51:47Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header
Details

Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (trustProxy) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of trustProxy to false. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set trustProxy: false in config file.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1188",
        "CWE-307"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66482.json"
}
References

Affected packages

Git / github.com/misskey-dev/misskey

Affected ranges

Type
GIT
Repo
https://github.com/misskey-dev/misskey
Events
Introduced
38fde26d603951b389d23ade204f22b0674b2cde
Fixed
3273ca751284d39ff507fe72305fce763111eff9
Introduced
d56fc4186529bf41fe840cb3497f1a363ac84475
Fixed
5512898463fa8487b9e6488912f35102b91f25f7
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:misskey:misskey:13.0.0:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "13.1.0"
        },
        {
            "fixed": "2025.12.0"
        },
        {
            "introduced": "13.0.0-NA"
        },
        {
            "last_affected": "13.0.0-NA"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

13.*
13.0.0-NA

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66482.json"