# CVE-2025-66482: Misskey login rate limit bypass via X-Forwarded-For spoofing

Source: https://junglewise.ai/threats/cve-2025-66482-misskey-login-rate-limit-bypass-via-x-forwarded-for-spoofing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-66482 · Severity: medium · CVSS 6.5 · Published 2025-12-16

Misskey is a decentralized social media platform. When misconfigured (or without a trusted reverse proxy), attackers can spoof their source IP address using a forged X-Forwarded-For header to bypass rate limiting on login attempts, enabling account brute-forcing attacks that would otherwise be blocked.

Technologies: [Misskey](https://junglewise.ai/threats/technologies/misskey-misskey). Vendors: [Misskey](https://junglewise.ai/threats/vendors/misskey), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-66482 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66482 being exploited in the wild.

**How severe is CVE-2025-66482?** Medium severity, with a CVSS score of 6.5, published 16 December 2025.

**Which products and versions are affected?** misskey-js (npm) SEMVER:introduced=2025.9.1,fixed=2025.12.0-alpha.2.

**Is there a fix for CVE-2025-66482?** Yes. misskey-js (npm): upgrade to 2025.12.0-alpha.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66482 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-66482?** Check whether you run Misskey or misskey-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- misskey-js (npm): upgrade to 2025.12.0-alpha.2 or later

  ```sh
  npm install misskey-js@2025.12.0-alpha.2
  ```


## Technical details

The vulnerability is a rate-limit bypass in the login endpoint (SigninApiService.ts) caused by improper trust of the X-Forwarded-For HTTP header. Affected versions (2025.9.1 through 2025.11.1) introduced a trustProxy configuration option but initialized it with an insecure default, causing the application to trust client-supplied X-Forwarded-For values for rate-limit IP tracking without validation. An unauthenticated attacker can send crafted POST requests to /api/signin-flow with spoofed X-Forwarded-For headers to perform brute-force attacks against user accounts. The vulnerability is patched in version 2025.12.0 by changing the trustProxy default to false. Workarounds are available by setting trustProxy: false in the configuration file for versions 2025.9.1–2025.11.1, or by deploying a trusted reverse proxy that filters this header.

## Affected products

- Misskey Misskey >=13.0.0-beta.16, <2025.12.0

## Identifiers

- CVE-2025-66482
- GHSA-wwrj-3hvj-prpm

## Timeline

- 2025-12-15: disclosed: GHSA-wwrj-3hvj-prpm published
- 2025-12-16: patched: Version 2025.12.0 released with fix

## References

- [https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm](https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm)

## Related threats

- [Misskey fetch-rss API missing rate limits and response size restrictions](https://junglewise.ai/threats/cve-2026-104817-misskey-is-an-open-source-federated-social-media-platform-from)
- [Misskey RSS widget XSS via unsafe URL scheme](https://junglewise.ai/threats/cve-2026-104816-misskey-is-an-open-source-federated-social-media-platform-from)
- [Misskey multipart API cleanup denial of service](https://junglewise.ai/threats/cve-2026-103937-misskey-is-an-open-source-federated-social-media-platform-from)
- [Misskey.js export data contains private post data](https://junglewise.ai/threats/cve-2025-66402-misskey-js-export-data-contains-private-post-data)