CVE-2025-66482: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66482 is a login rate limit bypass vulnerability in Misskey, an open-source federated social media platform, caused by improper trust of the X-Forwarded-For HTTP header. Attackers operating without a trusted reverse proxy can forge this header to spoof their IP address and circumvent IP-based rate limiting on the authentication endpoint, enabling brute-force attacks. The vulnerability affects Misskey versions >= 13.0.0-beta.16 through < 2025.12.0, and was disclosed on December 13, 2025. It carries a CVSS v4 base score of 6.9 (Medium) and a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Misskey Advisory).

The root cause is a combination of CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-1188 (Insecure Default Initialization of Resource). Specifically, the Fastify web framework's trustProxy option was defaulted to true in ServerService.ts (trustProxy: this.config.trustProxy ?? true), causing Misskey to unconditionally trust the client-supplied X-Forwarded-For header for IP identification. The vulnerable code path is in packages/backend/src/server/api/SigninApiService.ts at line 94, where the rate limiter reads the client IP from this header. An unauthenticated attacker can send repeated POST requests to /api/signin-flow with a rotating forged X-Forwarded-For header value, effectively presenting a different IP to the rate limiter on each attempt and bypassing the lockout mechanism entirely (Misskey Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to conduct unlimited brute-force or credential-stuffing attacks against any user account on a vulnerable Misskey instance without being blocked by rate limiting. This can lead to unauthorized account takeover, exposure of private posts and direct messages, and potential for further actions within the platform under the compromised account's privileges. The availability impact is low (rate limiting degraded), and integrity is low (unauthorized authentication state changes), while confidentiality of the platform's data is indirectly at risk through account compromise (Github Advisory).

A proof-of-concept is publicly documented in the official security advisory, demonstrating exploitation via a simple HTTP POST request with a forged X-Forwarded-For header to /api/signin-flow. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.09% (26th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify a publicly accessible Misskey instance running a version between 13.0.0-beta.16 and 2025.11.x (before 2025.12.0) that is not using a trusted reverse proxy or has trustProxy set to true (the insecure default).
2. Identify target account: Enumerate or guess a valid username (e.g., admin) on the target Misskey instance.
3. Craft malicious request: Prepare a POST request to /api/signin-flow with a Content-Type: application/json body containing the target username and a password guess, and include a forged X-Forwarded-For header with a spoofed IP address.
4. Rotate IP in header: For each subsequent login attempt, change the value of the X-Forwarded-For header to a different IP address (e.g., incrementing through a range), causing the rate limiter to treat each request as originating from a new IP.
5. Brute-force credentials: Automate the above requests using a tool such as curl, ffuf, or a custom script with a password wordlist, iterating through passwords without triggering the rate limit lockout.
6. Achieve account takeover: Upon receiving a successful authentication response, use the obtained session token to access the victim's account (Misskey Advisory).

• Network: High volume of POST requests to /api/signin-flow from a single IP or a small set of IPs, each with a different X-Forwarded-For header value; requests with X-Forwarded-For values that do not match the actual connecting IP.
• Logs: Misskey/Fastify access logs showing repeated failed authentication attempts for the same username with varying X-Forwarded-For values; absence of rate-limit block responses (HTTP 429) despite many failed logins for a single account.
• Application Behavior: Sudden successful login for an account following a large number of failed attempts; login events from IP addresses inconsistent with the user's normal geographic location or access patterns.

The vulnerability is patched in Misskey version 2025.12.0, which flips the default value of trustProxy to false in ServerService.ts. Administrators running versions 2025.9.1 through 2025.11.1 can apply the workaround by explicitly setting trustProxy: false in their Misskey configuration file. Instances running behind a trusted, properly configured reverse proxy are not affected by this vulnerability. All administrators should upgrade to 2025.12.0 or later as the primary remediation, and optionally enable multi-factor authentication to reduce the risk of credential-based account takeover (Misskey Advisory, Patch Commit).