CVE-2026-57574 Details
Description
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.
A vulnerability exists in Misskey, a federated social media platform, in versions prior to 2026.6.0. The issue lies within the Time-based One-Time Password (TOTP) authentication process in the UserAuthService. Insufficient validation of used tokens permits the reuse of a single-use code within its valid time step. According to RFC 6238, verifiers must not accept a second use of an OTP that has already been validated. If an attacker obtains both credentials and a TOTP code simultaneously, they can reuse the code to execute unauthorized actions, potentially leading to account takeover.
Users can update to Misskey version 2026.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/misskey-dev/misskey/commit/00c6210a591db2b0be438740d05b82070fa68ac6 | [email protected] | Source CodeVendor |
| https://github.com/misskey-dev/misskey/commit/d323fe00d04ac46ab0b4e66fce9169effaa8dfb7 | [email protected] | Source CodeVendor |
| https://github.com/misskey-dev/misskey/releases/tag/2026.6.0 | [email protected] | Release NotesVendor |
| https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m5x-5mp6-6vpq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Misskey | < 2026.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |