CVE-2025-24896: Misskey allows token to remain valid in cookie after signing out
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named token is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary affected users will be users who have logged into Misskey using a public PC or someone else's device, but it's possible that users who have logged out of Misskey before lending their PC to someone else could also be affected. Version 2025.2.0-alpha.0 contains a fix for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24896?
CVE-2025-24896 is considered a medium severity vulnerability due to improper handling of authentication tokens.
How do I fix CVE-2025-24896?
To fix CVE-2025-24896, update Misskey to version 2025.2.0-alpha.0 or later, which properly handles cookie deletion upon logout.
What versions of Misskey are affected by CVE-2025-24896?
CVE-2025-24896 affects Misskey versions starting from 12.109.0 up to but not including 2025.2.0-alpha.0.
What type of vulnerability is CVE-2025-24896?
CVE-2025-24896 is an authentication vulnerability stemming from improper token management in cookies.
Is CVE-2025-24896 a practical attack vector?
Yes, CVE-2025-24896 can potentially allow an attacker to exploit stale authentication tokens after a user logs out.