Is CVE-2025-66482 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66482 being exploited in the wild.

How severe is CVE-2025-66482?

Medium severity, with a CVSS score of 6.5, published 16 December 2025.

Which products and versions are affected?

misskey-js (npm) SEMVER:introduced=2025.9.1,fixed=2025.12.0-alpha.2.

Is there a fix for CVE-2025-66482?

Yes. misskey-js (npm): upgrade to 2025.12.0-alpha.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66482 attacked?

It is attacked over the network.

Am I affected by CVE-2025-66482?

Check whether you run Misskey or misskey-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66482: Misskey login rate limit bypass via X-Forwarded-For spoofing

CVE-2025-66482 · Severity: medium · CVSS 6.5 · Published 2025-12-16

Misskey is a decentralized social media platform. When misconfigured (or without a trusted reverse proxy), attackers can spoof their source IP address using a forged X-Forwarded-For header to bypass rate limiting on login attempts, enabling account brute-forcing attacks that would otherwise be blocked.

Technologies: Misskey. Vendors: Misskey, npm.

Quick answers

Is CVE-2025-66482 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66482 being exploited in the wild.
How severe is CVE-2025-66482?: Medium severity, with a CVSS score of 6.5, published 16 December 2025.
Which products and versions are affected?: misskey-js (npm) SEMVER:introduced=2025.9.1,fixed=2025.12.0-alpha.2.
Is there a fix for CVE-2025-66482?: Yes. misskey-js (npm): upgrade to 2025.12.0-alpha.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66482 attacked?: It is attacked over the network.
Am I affected by CVE-2025-66482?: Check whether you run Misskey or misskey-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

misskey-js (npm): upgrade to 2025.12.0-alpha.2 or later
```
npm install misskey-js@2025.12.0-alpha.2
```

Technical details

The vulnerability is a rate-limit bypass in the login endpoint (SigninApiService.ts) caused by improper trust of the X-Forwarded-For HTTP header. Affected versions (2025.9.1 through 2025.11.1) introduced a trustProxy configuration option but initialized it with an insecure default, causing the application to trust client-supplied X-Forwarded-For values for rate-limit IP tracking without validation. An unauthenticated attacker can send crafted POST requests to /api/signin-flow with spoofed X-Forwarded-For headers to perform brute-force attacks against user accounts. The vulnerability is patched in version 2025.12.0 by changing the trustProxy default to false. Workarounds are available by setting trustProxy: false in the configuration file for versions 2025.9.1–2025.11.1, or by deploying a trusted reverse proxy that filters this header.

Affected products

Misskey Misskey >=13.0.0-beta.16, <2025.12.0

Identifiers

CVE-2025-66482
GHSA-wwrj-3hvj-prpm

Timeline

2025-12-15: disclosed: GHSA-wwrj-3hvj-prpm published
2025-12-16: patched: Version 2025.12.0 released with fix

References

https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.