Vickey Unexpired Email Confirmation Link Reuse Vulnerability

A vulnerability in Vickey, a Misskey-based microblogging platform, exists in versions prior to 2025.10.0. The issue allows unexpired email confirmation links to be reused, leading to repeated confirmation emails being sent to a verified email address. This could result in unnecessary email traffic, although it does not compromise user data. The vulnerability was addressed in version 2025.10.0 by enhancing the validation logic to ensure that verification links function correctly after they have been used.

Impact

Exploitation of this vulnerability could cause a verified email address to receive multiple confirmation emails, creating unnecessary email traffic.

Remediation

Users can upgrade to Vickey version 2025.10.0 or later to address this vulnerability.