Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
Priority MEDIUM 45CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0028 20th percentileScored 2026-11-07
Fix Fixed misskey (misskey-dev): 2026.5.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| misskey-dev | misskey | 12.37.0 to before 2026.5.4 | 2026.5.4 | Patch available | CNA |
- misskey Vendormisskey-dev Affected 12.37.0 to before 2026.5.4 Fixed in 2026.5.4 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* | — | — | misskey-dev |
- cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions — — ·misskey-dev
Remediation
- Fix · CNA misskey (misskey-dev) Fixed in 2026.5.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46713
References
More misskey-dev vulnerabilities
- TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
- TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
- TI-2025-40906 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
- TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
- TI-2025-40839 misskey.js's export data contains private post data CVSS 4.0HIGH 7.1
- TI-2025-29271 @misskey-dev/summaly Redirect Filter Bypass CVSS 4.0LOW 2.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences