PT-2025-10614

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 2025.2.1 Description The issue concerns the validation of the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the...

biscuit-java vulnerable to public key confusion in third party block

Impact Tokens with third-party blocks containing trusted annotations generated through a third party block request. Due to implementation issues in biscuit-java, third party block support in published versions is inoperating. Nevertheless, to synchronize with other implementations, we publish thi...