CVE-2025-61775
MEDIUM EPSS 22.5%
Published Oct 13, 20258mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Published Oct 13, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago
Description
Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address could receive repeated confirmation messages if the verification link was accessed multiple times. This issue may result in unintended email traffic but does not expose user data. The issue was addressed in version 2025.10.0 by improving validation logic to ensure verification links behave as expected after completion.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
22.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-613
CWE-770
References 1
- github.com https://github.com/Whimsies-YAT/Vickey/security/advisories/GHSA-q6hp-37x8-fhm7
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.