Executive brief
Misskey, an open-source social media platform, contains a security flaw in its two-factor authentication system. The software fails to properly invalidate one-time passwords (TOTP) after they have been used, allowing them to be reused within a short time window. If an attacker manages to intercept a user's login credentials and their active security code, they could gain full access to the account, potentially leading to data theft or unauthorized activity.
Technical details
A vulnerability in Misskey's UserAuthService allows for the replay of Time-based One-Time Password (TOTP) tokens. The application fails to implement a mechanism to track and invalidate tokens that have already been successfully validated within their current time step, violating RFC 6238 guidelines. An attacker who concurrently obtains a user's primary credentials and a valid TOTP code (e.g., via man-in-the-middle or phishing) can reuse that code to authenticate before the time step expires. This can result in full account takeover. The issue is addressed in version 2026.6.0 by implementing stricter token validation.
Affected products
- misskey-dev Misskey < 2026.6.0
Timeline
- 2026-06-22: patched: Fix included in release 2026.6.0
- 2026-07-02: advisory: GitHub Security Advisory GHSA-2m5x-5mp6-6vpq published
- 2026-07-10: disclosed: CVE-2026-57574 published to NVD
References
- https://github.com/misskey-dev/misskey/commit/00c6210a591db2b0be438740d05b82070fa68ac6
- https://github.com/misskey-dev/misskey/commit/d323fe00d04ac46ab0b4e66fce9169effaa8dfb7
- https://github.com/misskey-dev/misskey/releases/tag/2026.6.0
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m5x-5mp6-6vpq