CVE-2025-61775: Vickey Auth Bypass Vulnerability

CVE-2025-61775 Overview

CVE-2025-61775 affects Vickey, a Misskey-based microblogging platform. The vulnerability allows unexpired email confirmation links to be reused multiple times. Reusing a link triggers repeated confirmation emails to an already-verified email address. Attackers can abuse this behavior to generate unintended email traffic to verified users.

The issue does not expose user data or credentials. Vickey versions prior to 2025.10.0 are affected. Maintainers addressed the flaw in version 2025.10.0 by improving validation logic so verification links no longer function after completion. This vulnerability is categorized under [CWE-613] (Insufficient Session Expiration).

Critical Impact
Attackers can repeatedly reuse valid email confirmation links to flood verified email addresses with confirmation messages, generating unwanted email traffic without exposing user data.

Affected Products

Vickey versions prior to 2025.10.0
Misskey-based deployments running affected Vickey builds
Self-hosted Vickey instances with email verification enabled

Discovery Timeline

2025-10-13 - CVE-2025-61775 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61775

Vulnerability Analysis

The vulnerability stems from improper session expiration handling in Vickey's email confirmation workflow. When a user requests email verification, the platform generates a confirmation link tied to a token. After the user completes verification, the token remains valid until its natural expiration. Any party with access to the link can request it again and trigger the server to resend a confirmation email to the already-verified address.

The root issue is a missing state check after successful verification. The server should invalidate the token once verification completes. Instead, it accepts repeated requests and continues to dispatch confirmation messages. This behavior is a classic instance of [CWE-613] where authentication artifacts persist beyond their intended lifecycle.

Impact is limited to email traffic abuse. An attacker who obtains or intercepts a verification link, or a malicious client replaying its own link, can amplify outbound email volume from the Vickey instance. Downstream effects include recipient inbox spam, potential deliverability degradation for the sending domain, and mail service quota consumption.

Root Cause

The verification endpoint does not mark tokens as consumed after the first successful confirmation. Validation logic checks token authenticity and expiry, but not completion state. Version 2025.10.0 corrects this by ensuring verification links behave as single-use artifacts.

Attack Vector

The attack requires network access to the Vickey instance and possession of a valid, unexpired verification link. No authentication or user interaction is required beyond the initial link exposure. An attacker replays the confirmation URL repeatedly, causing the server to resend confirmation emails on each request. See the GitHub Security Advisory for full technical context.

Detection Methods for CVE-2025-61775

Indicators of Compromise

Repeated HTTP requests to the same email verification endpoint from a single client or IP within a short window
Multiple confirmation emails sent to the same recipient address in server mail logs
Elevated outbound SMTP volume from the Vickey instance disproportionate to new user registrations
Web access logs showing verification token reuse after the initial successful verification

Detection Strategies

Monitor Vickey application logs for duplicate verification requests using the same token identifier
Correlate SMTP relay logs with verification endpoint hits to identify amplification patterns
Alert when a single verification token is used more than once within its validity window
Baseline normal verification email volume and flag statistical deviations

Monitoring Recommendations

Ingest Vickey web server and mail transfer agent logs into a centralized logging platform
Track per-token request counts and alert on values greater than one
Monitor bounce rates and recipient complaints as secondary signals of abuse
Review rate-limiting metrics on the /email-verify or equivalent endpoint

How to Mitigate CVE-2025-61775

Immediate Actions Required

Upgrade Vickey to version 2025.10.0 or later without delay
Audit mail server logs for evidence of repeated confirmation email dispatch
Rotate any long-lived verification tokens issued by vulnerable versions
Review and tighten SMTP relay quotas to limit downstream impact if abuse occurs

Patch Information

Vickey version 2025.10.0 addresses the flaw by improving validation logic so verification links become invalid after successful completion. Administrators should follow the upgrade guidance in the GitHub Security Advisory GHSA-q6hp-37x8-fhm7.

Workarounds

Apply rate limiting at the reverse proxy or web application firewall to cap requests per verification token
Reduce the token lifetime configured in Vickey to shrink the abuse window
Temporarily disable self-service email change flows until the patch is deployed
Enforce per-IP request throttling on the verification endpoint to slow amplification attempts

bash

# Example nginx rate-limit configuration for the verification endpoint
limit_req_zone $binary_remote_addr zone=email_verify:10m rate=5r/m;

server {
    location /email-verify {
        limit_req zone=email_verify burst=3 nodelay;
        proxy_pass http://vickey_backend;
    }
}