CVE-2026-57574: Misskey TOTP Auth Bypass Vulnerability

CVE-2026-57574 Overview

Misskey, an open source federated social media platform, contains an authentication weakness in its Time-based One-Time Password (TOTP) implementation. The flaw resides in UserAuthService where the backend fails to invalidate a TOTP code after successful use. An attacker who concurrently obtains a victim's credentials and a valid TOTP code can replay that code within its time step window to authenticate. This condition weakens the second factor to a single-use replay artifact and can lead to account takeover. The issue is tracked as [CWE-294: Authentication Bypass by Capture-replay] and is fixed in Misskey 2026.6.0.

Critical Impact
Successful replay of an intercepted TOTP code allows unauthorized authentication and full account takeover on affected Misskey instances.

Affected Products

Misskey versions prior to 2026.6.0
UserAuthService component in packages/backend/src/core/UserAuthService.ts
Two-factor authentication endpoint packages/backend/src/server/api/endpoints/i/2fa/done.ts

Discovery Timeline

2026-07-10 - CVE-2026-57574 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57574

Vulnerability Analysis

The vulnerability affects Misskey's TOTP validation logic in UserAuthService. TOTP codes are derived from a shared secret and a time counter, typically valid for 30 seconds. Secure implementations must track consumed codes within the valid window to prevent replay. Misskey did not persist used token identifiers, so the same six-digit code remained valid until its time step expired.

An attacker who captures both the password and the current TOTP code, for example via a phishing proxy or shoulder surfing, can submit the same code before the window closes. Because attack complexity is high and user interaction is required to expose the credentials, exploitation is conditional but reliable once prerequisites are met.

Root Cause

The root cause is insufficient state tracking of consumed TOTP tokens. The service validated the code against the shared secret and current time step but did not record the token as spent. Combined with a lack of atomic "check-and-consume" semantics, this permitted parallel or sequential reuse of the same code within the valid interval.

Attack Vector

Exploitation requires network access to the Misskey instance and prior capture of both a valid password and a live TOTP code. The attacker submits the captured code through the standard authentication endpoint before the time step expires. No elevated privileges are needed on the target account before authentication.

typescript

// Patch: introduce Redis-backed tracking and hashing of consumed TOTP tokens
// packages/backend/src/core/UserAuthService.ts
 import { Inject, Injectable } from '@nestjs/common';
 import * as Redis from 'ioredis';
 import * as OTPAuth from 'otpauth';
+import { createHash } from 'node:crypto';
 import { DI } from '@/di-symbols.js';
 import type { MiUserProfile, UserProfilesRepository, UsersRepository } from '@/models/_.js';
 import { bindThis } from '@/decorators.js';

Source: Misskey commit 00c6210

typescript

// Patch: inject Redis client into UserAuthService for consumed-token bookkeeping
 import { Inject, Injectable } from '@nestjs/common';
-import { QueryFailedError } from 'typeorm';
+import * as Redis from 'ioredis';
 import * as OTPAuth from 'otpauth';

 @Injectable()
 export class UserAuthService {
 	constructor(
+		@Inject(DI.redis)
+		private redisClient: Redis.Redis,
+
 		@Inject(DI.usersRepository)
 		private usersRepository: UsersRepository,

Source: Misskey commit d323fe0

The fix hashes each accepted TOTP code with createHash and stores it in Redis for the duration of the valid time step. Subsequent submissions of the same code are rejected before authentication completes.

Detection Methods for CVE-2026-57574

Indicators of Compromise

Multiple successful authentication events for the same user within a single TOTP time step from differing source IP addresses or user agents.
Repeated identical TOTP submissions in application logs originating from distinct sessions.
Unexpected 2fa/done or session creation events immediately followed by profile, key, or email changes.

Detection Strategies

Correlate authentication logs by user, TOTP time step, and source IP to surface concurrent logins that could indicate code replay.
Alert on privileged post-login actions such as API token generation or 2FA reconfiguration that occur within 30 seconds of two separate authentications.
Baseline typical TOTP submission latency per user and flag replays that arrive from previously unseen network locations.

Monitoring Recommendations

Enable verbose logging on Misskey backend authentication paths including UserAuthService and i/2fa/done.
Forward web server, reverse proxy, and application logs to a centralized analytics pipeline for cross-source correlation.
Monitor Redis key patterns introduced by the patch to confirm the consumed-token cache is active after upgrade.

How to Mitigate CVE-2026-57574

Immediate Actions Required

Upgrade Misskey to version 2026.6.0 or later on all self-hosted instances.
Force session invalidation for all users after upgrade to purge any sessions established via replayed codes.
Require affected users to rotate passwords and regenerate TOTP secrets if suspicious activity is observed.

Patch Information

The fix is included in Misskey release 2026.6.0. Technical details are documented in GitHub Security Advisory GHSA-2m5x-5mp6-6vpq. The remediation introduces Redis-backed tracking of hashed TOTP codes so a submitted code cannot be accepted twice within its valid window.

Workarounds

Restrict administrative access to the Misskey instance behind a VPN or IP allowlist until the upgrade is applied.
Enforce WebAuthn or passkey-based second factors where supported, reducing reliance on TOTP.
Shorten session lifetimes and require reauthentication for sensitive account operations.

bash

# Upgrade Misskey using the official release tag
git fetch --all --tags
git checkout 2026.6.0
pnpm install
pnpm run build
pnpm run migrate
systemctl restart misskey