If you discover a security issue in Misskey, please report it by this form.
This will allow us to assess the risk, and make a fix available before we add a bug report to the GitHub repository.
Thanks for helping make Misskey safe for everyone.
Security: misskey-dev/misskey
Security
SECURITY.md
-
Impersonation and takeover of remote accounts with unnormalized signed activitiesGHSA-2vxv-pv3m-3wvj published
Jun 2, 2024 by syuiloHigh -
Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accountsGHSA-qqrm-9grj-6v32 published
Feb 17, 2024 by syuiloHigh -
Improper authorization when accessing with third-party applicationGHSA-7pxq-6xx9-xpgm published
Dec 29, 2023 by syuiloCritical -
Misskey's missing signature validation allows arbitrary users to impersonate any remote user.GHSA-3f39-6537-3cgc published
Nov 25, 2023 by syuiloCritical -
Bypass authentication of Bull dashboardGHSA-9fj2-gjcf-cqqc published
Sep 30, 2023 by syuiloHigh -
XSS of ActivityPub URIGHSA-pfp5-r48x-fg25 published
Feb 22, 2023 by syuiloHigh -
SQL injection of notes/search-by-tagGHSA-cgwp-vmr4-wx4q published
Feb 22, 2023 by syuiloHigh -
XSS vulnerability using url previewGHSA-vc39-c453-67g3 published
Feb 22, 2023 by syuiloHigh -
XSS vulnerability using authentication callbackGHSA-cc6r-chgr-8r5m published
Feb 22, 2023 by syuiloHigh -
Server-Side Request Forgery vulnerability in downloadGHSA-mqv7-gxh4-r5vf published
Sep 7, 2021 by syuiloHigh
Learn more about advisories related to misskey-dev/misskey in the GitHub Advisory Database