CVE-2023-49079: Misskey's missing signature validation allows arbitrary users to impersonate any remote user.
Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-49079?
CVE-2023-49079 is a vulnerability in Misskey that allows arbitrary users to impersonate any remote user due to missing signature validation.
What is the severity of CVE-2023-49079?
The severity of CVE-2023-49079 is critical (CVSS score 9.3).
How does the vulnerability in Misskey allow arbitrary user impersonation?
The missing signature validation in Misskey allows attackers to forge user signatures, enabling them to impersonate any remote user.
Has the vulnerability in Misskey been patched?
Yes, the vulnerability in Misskey has been patched in version 2023.11.1-beta.1.
Where can I find more information about CVE-2023-49079?
More information about CVE-2023-49079 can be found at the following link: [GitHub Security Advisory](https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc)