Security Advisory

CVE-2026-57574

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-10 20:55:49

Last updated 2026-07-13 18:55:15

Assigner GitHub_M

CVSS score 7.4

State PUBLISHED

Description

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.

← Browse all CVEs View on cve.org ↗