VULNERABILITY INTELLIGENCE
CVE-2026-57574
EPSS probability0.55%
CISA KEVNot currently listed
Published2026-07-10
Last modified2026-10-25
Description
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.
Weakness classification
- security-advisories@github.com: CWE-294