CVE-2023-24810 - CVE House
Back to Database
Status published High CVE-2023-24810

Cross site scripting (XSS) vulnerability using authentication callback in Misskey

Vulnerability Description

Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentication in Misskey, arbitrary JavaScript can be executed when a user allows the link. All versions below 13.3.1 (including 12.x) are affected. This has been fixed in version 13.3.1. Users are advised to upgrade. Users unable to upgrade should not allow authentication of untrusted apps.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24810

Credits & Attribution

No credits recorded in the NVD database.

References

More from misskey-dev

View All →
CVE-2025-66482
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header
Medium 6.9
CVE-2025-66402
misskey.js's export data contains private post data
High 7.1
CVE-2025-46559
Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`
Medium 5.4
CVE-2025-46553
@misskey-dev/summaly Redirect Filter Bypass
Low 2.1
CVE-2025-46340
Misskey CSS Style Injection Vulnerability In `MkUrlPreview`
High 7.2

Affected Vendor

misskey-dev

View all reports →

Affected Software

misskey
Vulnerable Versions:
< 13.3.1

Timeline

Official Publish: February 22nd, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact