CVE-2025-66482

Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`trustProxy`) has been added in config file to prevent this from happening. However, it is initialized with an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if the configuration is not set correctly. This is patched in v2025.12.0-alpha.2 by flipping default value of `trustProxy` to `false`. Users of a trusted reverse proxy who are unsure if they manually overode this value should check their config for optimal behavior. Users are running Misskey with a trusted reverse proxy should not be affected by this vulnerability. From v2025.9.1 to v2025.11.1, workaround is available. Set `trustProxy: false` in config file.

• CWE-307
• CWE-1188

• https://github.com/misskey-dev/misskey/commit/5512898463fa8487b9e6488912f35102b91f25f7Patch
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpmExploit, Vendor Advisory
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpmExploit, Vendor Advisory

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66476Vim is an open source, command line text editor. Prior to ve…7.8
• CVE-2025-66478Rejected reason: This CVE is a duplicate of CVE-2025-55182.
• CVE-2025-66479Anthropic Sandbox Runtime is a lightweight sandboxing tool f…1.8
• CVE-2025-6648PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Infor…3.3
• CVE-2025-66480Wildfire IM is an instant messaging and real-time audio/vide…9.8
• CVE-2025-66481DeepChat is an open-source AI chat platform that supports cl…9.6
• CVE-2025-66483IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate s…6.5
• CVE-2025-66484IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stor…5.4
• CVE-2025-66485IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP…5.4
• CVE-2025-66486IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML…6.1
• CVE-2025-66487IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rat…6.5
• CVE-2025-66488Discourse is an open source discussion platform. A vulnerabi…6.1