CVE-2026-28432: Misskey

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1.

Affected products

• Misskey Misskey: before 2026.3.1 (fixed in 2026.3.1)

Published 2026-03-10. Last modified 2026-06-17.