CVE-2026-28432
HTTP Signature Verification Bypass in Misskey Prior to
Publication date: 2026-03-10
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| misskey | misskey | to 2026.3.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28432 is a high-severity vulnerability in Misskey, an open source federated social media platform. It allows attackers to bypass HTTP signature verification, which is a critical security mechanism used to authenticate requests. This flaw exists in all Misskey servers running versions prior to 2026.3.1 and affects all servers regardless of whether federation is enabled or disabled.
The vulnerability is due to improper verification of cryptographic signatures (CWE-347), where the product either fails to verify or incorrectly verifies HTTP signatures.
- Affected Versions: All Misskey versions before 2026.3.1
- Patched Version: 2026.3.1
- Attack Vector: Network-based, allowing remote exploitation without physical access
- Attack Complexity: Low
- Privileges Required: null
- User Interaction: null
How can this vulnerability impact me? :
This vulnerability allows attackers to bypass HTTP signature verification, compromising the integrity of requests made to Misskey servers.
Because attackers can forge or manipulate authenticated requests without needing any privileges or user interaction, this poses a significant risk to system integrity.
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: null
There are no known workarounds, so immediate upgrading to version 2026.3.1 is strongly recommended to mitigate this risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade all Misskey servers to version 2026.3.1 or later.
There are no available workarounds for this vulnerability, so applying the official patch is critical.
Upgrading will fix the improper verification of HTTP signatures and restore the integrity of authenticated requests.