Executive brief
Misskey is a decentralized social media platform. When misconfigured (or without a trusted reverse proxy), attackers can spoof their source IP address using a forged X-Forwarded-For header to bypass rate limiting on login attempts, enabling account brute-forcing attacks that would otherwise be blocked.
Technical details
The vulnerability is a rate-limit bypass in the login endpoint (SigninApiService.ts) caused by improper trust of the X-Forwarded-For HTTP header. Affected versions (2025.9.1 through 2025.11.1) introduced a trustProxy configuration option but initialized it with an insecure default, causing the application to trust client-supplied X-Forwarded-For values for rate-limit IP tracking without validation. An unauthenticated attacker can send crafted POST requests to /api/signin-flow with spoofed X-Forwarded-For headers to perform brute-force attacks against user accounts. The vulnerability is patched in version 2025.12.0 by changing the trustProxy default to false. Workarounds are available by setting trustProxy: false in the configuration file for versions 2025.9.1–2025.11.1, or by deploying a trusted reverse proxy that filters this header.
Affected products
- Misskey Misskey >=13.0.0-beta.16, <2025.12.0
Timeline
- 2025-12-15: disclosed: GHSA-wwrj-3hvj-prpm published
- 2025-12-16: patched: Version 2025.12.0 released with fix