Description
Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| misskey-dev | misskey | affected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Misskey | Misskey | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-wwrj-3hvj-prpm | Misskey has a login rate limit bypass via spoofed X-Forwarded-For header |
References
History
Tue, 06 Jan 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:-:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta16:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta21:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta22:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta23:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta24:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta25:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta26:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta27:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta28:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta29:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta30:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta31:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta32:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta33:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta34:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta35:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta36:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta37:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta38:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta39:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta40:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta41:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta42:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:beta43:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc10:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc11:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc1:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc2:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc3:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc4:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc5:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc6:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc7:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc8:*:*:*:*:*:* cpe:2.3:a:misskey:misskey:13.0.0:rc9:*:*:*:*:*:* |
|
| Metrics |
cvssV3_1
|
Tue, 16 Dec 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Misskey
Misskey misskey |
|
| Vendors & Products |
Misskey
Misskey misskey |
Tue, 16 Dec 2025 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 15 Dec 2025 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file. | |
| Title | Misskey has a login rate limit bypass via spoofed X-Forwarded-For header | |
| Weaknesses | CWE-1188 CWE-307 |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-12-16T15:09:19.925Z
Reserved: 2025-12-02T17:09:52.016Z
Link: CVE-2025-66482
Vulnrichment
Updated: 2025-12-16T14:37:29.779Z
NVD
Status : Analyzed
Published: 2025-12-16T00:16:02.503
Modified: 2026-01-06T19:41:47.383
Link: CVE-2025-66482
Redhat
No data.
OpenCVE Enrichment
Updated: 2025-12-16T17:09:39Z