Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-66482 · Microsoft / collected KEV context

EUVD-2025-203441

GHSA-wwrj-3hvj-prpm

cve-program · CVE-2025-66482

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm
• https://github.com/misskey-dev/misskey/commit/5512898463fa8487b9e6488912f35102b91f25f7

euvd · EUVD-2025-203441

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm
• https://github.com/misskey-dev/misskey/commit/5512898463fa8487b9e6488912f35102b91f25f7

nvd · CVE-2025-66482

• https://github.com/misskey-dev/misskey/commit/5512898463fa8487b9e6488912f35102b91f25f7
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm

osv · GHSA-wwrj-3hvj-prpm

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm
• https://nvd.nist.gov/vuln/detail/CVE-2025-66482
• https://github.com/misskey-dev/misskey/commit/5512898463fa8487b9e6488912f35102b91f25f7
• https://github.com/misskey-dev/misskey

No related operational record is retained in the current change model.