PT-2026-24121 · Misskey · Misskey

49016 + 1 · Published 2026-03-09 · Updated 2026-03-13 · CVE-2026-28432

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 2026.3.1

Description Misskey is a federated social media platform. All servers prior to version 2026.3.1 are susceptible to an issue that allows bypassing HTTP signature verification. This affects all servers, even those with federation disabled.

Recommendations Update to version 2026.3.1 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-28432

GHSA-GRWC-C762-GCVP

Affected Products

Misskey

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28432.json · Exploit
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-grwc-c762-gcvp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28432 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28432 · Security Note
• https://twitter.com/oss_security/status/2031085885781946632 · Twitter Post
• https://t.me/cveNotify/155437 · Telegram Post
• https://t.me/cveNotify/154895 · Telegram Post
• https://twitter.com/CVEnew/status/2031122505323176438 · Twitter Post