CVE-2025-24896 Misskey allows token to remain valid in cookie after signing out
Attackers can hijack accounts on shared devices because Misskey fails to delete authentication cookies upon logout.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-24896?
CVE-2025-24896 is a high-severity authentication bypass vulnerability in misskey-dev misskey, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `token` is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary affected users will be users who have logged into Misskey using a public PC or someone else's device, but it's possible that users who have logged out of Misskey before lending their PC to someone else could also be affected. Version 2025.2.0-alpha.0 contains a fix for this issue.
Weakness: CWE-613
Which versions are affected by CVE-2025-24896?
It affects 1 product.
Products include Misskey Misskey.
How do I fix CVE-2025-24896?
No fix has been published for CVE-2025-24896 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-24896 being exploited?
There is no known exploitation of CVE-2025-24896 in the wild and no public exploit code.
Other vulnerabilities in misskey-dev misskey
- CVE-2025-25306 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes
- CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user.
- CVE-2026-28431 Misskey lacks proper authorization checks and input validation
- CVE-2023-52139 Misskey vulnerable to improper authorization when accessing with third-party application
- CVE-2024-52590 Missing validation allows spoofed profiles in Misskey
Sources
Also known as GHSA-w98m-j6hq-cwjm.