CyberRota Analysis
AI-GeneratedMisskey's Time-based One-Time Password (TOTP) authentication mechanism in UserAuthService is vulnerable due to insufficient validation of tokens, allowing the reuse of single-use codes within their valid time step. This flaw could enable attackers to perform unauthorized actions and potentially take over accounts if they obtain both user credentials and a TOTP code simultaneously. Organizations using versions prior to 2026.6.0 should prioritize updating to mitigate the risk of account compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.