PT-2026-57330 · Misskey · Misskey
CVE-2026-57574
·
Published
2026-07-10
·
Updated
2026-07-10
CVSS v4.0
7.4
High
| Vector | AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Misskey versions prior to 2026.6.0
Description
Insufficient validation of used tokens in the Time-based One-Time Password (TOTP) authentication within the
UserAuthService allows a single-use code to be reused within its valid time step. If an attacker obtains both the user credentials and a TOTP code concurrently, they may reuse the code to perform unauthorized actions, which could lead to account takeover.Recommendations
Update to version 2026.6.0.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Misskey