CVE-2023-24810

Published: Feb 22, 2023Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentication in Misskey, arbitrary JavaScript can be executed when a user allows the link. All versions below 13.3.1 (including 12.x) are affected. This has been fixed in version 13.3.1. Users are advised to upgrade. Users unable to upgrade should not allow authentication of untrusted apps.

Affected (1)

Products: Misskey: Misskey

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Misskey Misskey	Before 13.3.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/misskey-dev/misskey/security/advisories/GHSA-cc6r-chgr-8r5m

Source: security-advisories@github.com

Vendor Advisory

https://github.com/misskey-dev/misskey/security/advisories/GHSA-cc6r-chgr-8r5m

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.