Misskey Login Token Cookie Persistence Vulnerability in Bull Dashboard

A vulnerability exists in Misskey versions 12.109.0 prior to 2025.2.0-alpha.0, where a login token named 'token' is stored in a cookie for authentication in Bull Dashboard. This token is not deleted upon logout, potentially exposing users to risks, especially those who have logged into Misskey on public or shared devices. Even users who logged out before lending their PC could be affected.

Impact

This vulnerability could lead to unauthorized access to a user's Misskey account by allowing someone else to use the valid login token stored in the cookie.

Remediation

Users can update to Misskey version 2025.2.0-alpha.0 or later, where this vulnerability has been fixed.