CVE-2025-24896
Misskey 12.109.0 – 2025.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2025-24896 is a high-severity Insufficient Session Expiration (CWE-613) vulnerability in Misskey Misskey. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-12 (Session Termination) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-24896 is a session management vulnerability in the Bull Dashboard component of Misskey, an open source federated social media platform. Affecting versions starting from 12.109.0 and prior to 2025.2.0-alpha.0, the issue stems from a login token named `token`, stored in a cookie for authentication, that persists even after a user logs out. This flaw, classified under CWE-613 (Insufficient Session Expiration), has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), indicating high severity due to its potential for remote exploitation with user interaction.
An attacker can exploit this vulnerability by accessing a victim's browser or device after the victim has logged out of Misskey, such as on a public PC or a shared device lent to someone else. By extracting the undeleted `token` cookie, the attacker can authenticate to the Bull Dashboard over the network without further privileges, achieving high confidentiality and integrity impacts. This enables unauthorized access to potentially sensitive queue management functions, effectively hijacking the session.
The Misskey security advisory (GHSA-w98m-j6hq-cwjm) and the fixing commit (ba9f295ef2bf31cc90fa587e20b9a7655b7a1824) confirm that version 2025.2.0-alpha.0 resolves the issue by properly deleting the token cookie upon logout. Security practitioners should advise Misskey administrators to update to 2025.2.0-alpha.0 or later and recommend users clear browser cookies or avoid shared devices for authentication.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3978
Vulnerability Data
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `token` is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after…
more
logout is performed. The primary affected users will be users who have logged into Misskey using a public PC or someone else's device, but it's possible that users who have logged out of Misskey before lending their PC to someone else could also be affected. Version 2025.2.0-alpha.0 contains a fix for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes enforcing session expiration to prevent reuse.
Authorization policy enforcement and review covers terminating stale sessions to limit access scope.
Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Automatic termination of inactive sessions and limits on connection duration shrink the window during which a hijacked or unattended authenticated session can be exploited.