Misskey: 3,380 application matches and a token scope decision

#cybersecurity #zoomeye #exposureinventory

Misskey: 3,380 application matches and a token scope decision

Misskey's API is broad enough that an access token can represent much of an account's authority. On 2026-11-04, ZoomEye returned 3,380 matches for app="Misskey" and 715 for title="Misskey" with page 1, page size 1 and sub_type=all. These are matching assets, not confirmed vulnerable servers. The application count is large enough to justify a structured review of token permissions and administrative exposure.

Tokens carry account authority

Misskey documents access tokens tied to an account and a set of permissions. The token can be issued through the web interface, MiAuth or OAuth depending on the flow and version. Administrative permissions are separate and include actions such as federation management. A token issued to a third-party client should not receive administrative scopes merely because the account is an administrator.

Inventory the token list visible to each user and the applications that requested each token. Check scopes at issuance rather than assuming the provider enforced least privilege. Revoke tokens for clients that no longer need access, after role changes and after a credential incident.

Separate the public and administrative planes

A Misskey server may expose public notes, federation endpoints and a client API on the same origin. The admin interface and administrative API are a different authority plane. Check the proxy rules, the account role and the token used by each client.

Use safe unauthenticated requests to confirm that public metadata is intentionally available. Do not attempt administrative endpoints. For owned instances, test with an ordinary account and an administrator account separately. Confirm that an ordinary token receives an authorization error before a state change occurs.

Federation configuration is state worth protecting

Federation settings are policy controls. They determine which remote servers can influence local content and which local content may move outward. Changes should be logged and attributed to a specific administrator. Review the server's update process and the remote-domain blocklist or allowlist.

The title count is smaller than the application count. That can happen when the product name is not in the visible title or when a client application uses a different page structure. The application match is the better product lead, but a shared container image or copied header can still create a false positive.

A review sequence

Validate ownership and the public host.
Map administrator accounts and active tokens.
Review scopes for admin, federation and file access.
Check whether public registration and federation are intentional.
Test token revocation after an account role change.

ZoomEye narrows the external population. The control decision sits in Misskey's permission model. The key question is which of the many client and automation integrations can perform an administrative action, and whether that ability is visible in the token inventory.