Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-57574Misskey: TOTP tokens can be reused

High 7.4

In plain English

A high-severity security flaw in misskey from misskey-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)7.4High

Exploit odds (30 days)0.6%top 53.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authentication in UserAuthService where insufficient validation of used tokens allows the reuse of a single-use code within its valid time step. If both credentials and a TOTP code are obtained concurrently, an attacker may reuse the code to perform unauthorized actions, potentially leading to account takeover. This issue is fixed in version 2026.6.0.

Affected products (as reported)

Vendor	Product	Versions
misskey-dev	misskey	< 2026.6.0

Weakness: CWE-294 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/misskey-dev/misskey/security/advisories/GHSA-2m5x-5mp6-6vpq x_refsource_CONFIRM
https://github.com/misskey-dev/misskey/commit/00c6210a591db2b0be438740d05b82070fa68ac6 x_refsource_MISC
https://github.com/misskey-dev/misskey/commit/d323fe00d04ac46ab0b4e66fce9169effaa8dfb7 x_refsource_MISC
https://github.com/misskey-dev/misskey/releases/tag/2026.6.0 x_refsource_MISC