HTTP signature verification can be bypassed
Priority LOW 36CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix Fixed misskey (misskey-dev): 2026.3.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| misskey-dev | misskey | before 2026.3.1 | 2026.3.1 | Patch available | CNA |
- misskey Vendormisskey-dev Affected before 2026.3.1 Fixed in 2026.3.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* | before 2026.3.1 | Vulnerable | misskey-dev |
- cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions before 2026.3.1 Vulnerable ·misskey-dev
Remediation
- Fix · CNA misskey (misskey-dev) Fixed in 2026.3.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-28432
References
More misskey-dev Misskey vulnerabilities
- TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
- TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
- TI-2025-40906 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
- TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
- TI-2025-40839 misskey.js's export data contains private post data CVSS 4.0HIGH 7.1
- TI-2026-22705 Misskey lacks proper authorization checks and input validation CVSS 4.0CRITICAL 9.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences