CVE-2025-24897: Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the /queue directory with a web application firewall (WAF).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24897?
CVE-2025-24897 has been rated as a high severity vulnerability due to the lack of CSRF protection in Misskey.
How do I fix CVE-2025-24897?
To fix CVE-2025-24897, upgrade Misskey to version 2025.2.0-alpha.0 or later.
What versions of Misskey are affected by CVE-2025-24897?
Versions of Misskey from 12.109.0 up to but not including 2025.2.0-alpha.0 are affected by CVE-2025-24897.
What kind of vulnerability is CVE-2025-24897?
CVE-2025-24897 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the authentication cookies used in Misskey.
Are there any specific APIs impacted by CVE-2025-24897?
Yes, some of the APIs related to Bull’s dashboard in Misskey are impacted by CVE-2025-24897.