{"id":"CVE-2025-24897","aliases":["EUVD-2025-3979","GHSA-38w6-vx8g-67pp"],"status":"published","title":"Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes","description":"Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00137,"percentile":0.03149,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1275","CWE-352","CWE-614"],"published":"2025-02-11T15:20:29Z","modified":"2026-11-11T10:31:09Z","products":[{"vendor":"misskey","product":"misskey"},{"vendor":"misskey-dev","product":"misskey"}],"references":[{"url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-38w6-vx8g-67pp","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory"]},{"url":"https://github.com/misskey-dev/misskey/commit/77e421029cb564a97f42b6e41c9edce49f79cecd","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24897.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24897","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-24897","title":"Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes","description":"Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).","status":"published","published":"2025-02-11T15:20:29.237Z","modified":"2025-02-12T15:51:14.989Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-352","CWE-614","CWE-1275"],"updated_at":"2026-11-02T14:32:43.770144Z"}],"euvd":[{"id":"EUVD-2025-3979","description":"Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).","status":"published","published":"2025-02-11T15:20:29Z","modified":"2025-02-12T15:51:14Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T00:03:58.326443Z"}],"nvd":[{"id":"CVE-2025-24897","description":"Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).","status":"published","published":"2025-02-11T16:15:51.61Z","modified":"2026-06-17T08:59:48.377Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-352","CWE-614","CWE-1275"],"updated_at":"2026-11-02T14:10:50.916773Z"}],"osv":[{"id":"CVE-2025-24897","title":"Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes","description":"Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).","status":"published","published":"2025-02-11T15:20:29.237Z","modified":"2026-11-11T10:31:09.271614893Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-1275","CWE-352","CWE-614"],"updated_at":"2026-11-11T11:06:32.539944Z"}]}}