CVE-2025-25306: Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes
Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub object type require authority in the id field. Version 2025.2.1 addresses the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Misskeyto a version that resolves this vulnerability.Fixed in 2025.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25306?
CVE-2025-25306 has been rated as a medium-severity vulnerability due to its potential for exploitation in ActivityPub objects.
How do I fix CVE-2025-25306?
To fix CVE-2025-25306, update your Misskey installation to the latest version that addresses this vulnerability.
What products are affected by CVE-2025-25306?
CVE-2025-25306 affects the Misskey open source social media platform.
What type of vulnerability is CVE-2025-25306?
CVE-2025-25306 is a validation vulnerability related to the ActivityPub objects in Misskey.
Can CVE-2025-25306 be exploited by an attacker?
Yes, an attacker can exploit CVE-2025-25306 to forge ActivityPub objects and claim unauthorized authority.