Queue-job injection via broadly scoped authentication cookie

CSRF in Bull's dashboard in Misskey 12.109.0 and later before 2025.2.0-alpha.0 allows remote attackers to add arbitrary queue jobs. The login function in packages/frontend/src/account.ts writes the authentication token to a year-long cookie scoped to the entire site without Secure or SameSite attributes, so browsers attach it to cross-site requests targeting /queue. Exploitation requires a signed-in administrator to interact with attacker-controlled content; forged bull-board API requests can modify the job queue and interrupt service.