CVE-2026-46713 in Misskey
Summary
by MITRE • 08/04/2026
Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability affects Misskey, an open source federated social media platform that implements the ActivityPub protocol for decentralized communication. The flaw exists in the JSON-LD signature validation and compaction process, which are critical components for verifying the authenticity of federated activities across different instances. This weakness specifically impacts versions 12.37.0 through 2026.5.3, creating a window where malicious actors could exploit the signature validation mechanism to forge activities that appear legitimate within the federated network.
The technical flaw stems from insufficient validation of JSON-LD signatures during the compaction process, allowing attackers to manipulate ActivityPub messages by crafting signatures that bypass proper verification checks. This vulnerability is classified as a weakness in cryptographic implementation according to CWE-327 and represents a failure in proper signature validation as outlined in CWE-347. The issue directly impacts the integrity of federated communications by permitting spoofed activities to be accepted as valid within the platform's trust model.
The operational impact of this vulnerability extends beyond simple message forgery, potentially enabling attackers to perform unauthorized actions across federated networks. Malicious actors could create fake posts, comments, or other social media activities that appear to originate from legitimate users or instances, undermining the trust relationships that form the foundation of federated social platforms. This could lead to information pollution, reputation damage, and potential escalation to more serious attacks within the federated ecosystem where trust propagation occurs.
Mitigation strategies should focus on immediate deployment of version 2026.5.4 which contains the necessary fixes for JSON-LD signature validation. Organizations using affected versions should also implement monitoring for suspicious federated activities and consider temporarily disabling federation features until the update is applied. The fix addresses the core validation weakness by strengthening the signature verification process to properly handle JSON-LD compaction and ensuring that all signatures are validated against the complete canonical representation of the activity data. This vulnerability aligns with ATT&CK technique T1566.002 for social engineering through spoofed activities, emphasizing the need for robust cryptographic validation in federated systems.