CVE-2025-25306

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub...

CVE-2025-25306

Misskey CVE-2025-25306 concerns insufficient validation of the relation between the id and url fields in ActivityPub objects, allowing forging of objects and potential authenticity claims across instances. Affected version is before 2025.2.1, with the issue addressed in 2025.2.1. Concrete technic...