CVE-2026-46713

CriticalCVSS 9.2

Published: 03/08/2026(UTC)Translated: 04/08/2026(UTC)NVD NIST

Summary

Misskey, an open source federated social media platform, has a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid.

Risk Assessment

An attacker can impersonate other users and spread fake content, undermining trust in the platform.

Recommendation

Immediately upgrade Misskey to version 2026.5.4 or later.

Original NVD description (English source)

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4.