CVE-2026-47746 in Misskey
Summary
by MITRE • 08/04/2026
Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and subsequent processing, the application may trust information that should not be trusted, resulting in a time-of-check to time-of-use (TOCTOU) flaw. This allows an attacker to have fraudulent activities accepted as valid, leading to a loss of integrity. This issue has been fixed in version 2026.5.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability in Misskey versions 12.37.0 through 2026.5.3 represents a critical timing attack flaw that undermines the platform's security model during JSON-LD signature validation processes. This weakness arises from improper handling of the JSON-LD parsing context which creates a temporal discrepancy between signature verification and subsequent data processing operations. The flaw specifically manifests when the application performs signature validation followed by compaction operations without maintaining consistent state information between these processes, creating an opportunity for malicious actors to exploit timing variations in cryptographic operations.
The technical implementation of this vulnerability stems from a fundamental design issue where the JSON-LD parsing context is not properly shared across different phases of the verification workflow. During signature validation, the system performs cryptographic operations that take measurable time based on input characteristics, while the subsequent compaction phase processes the same data without proper contextual awareness. This architectural gap enables attackers to perform timing analysis against the cryptographic functions and infer information about the validation process itself, ultimately allowing them to craft malicious payloads that appear legitimate to the verification system.
From an operational perspective, this vulnerability creates a severe integrity risk within the federated social media platform's security framework. The time-of-check to time-of-use flaw means that attackers can manipulate data between the initial signature verification phase and the final processing stage, causing the system to accept fraudulent activities as valid. This compromise affects the core trust model of the federated network where nodes must verify the authenticity of messages before accepting them into their distributed systems. The impact extends beyond individual accounts to potentially undermine the entire federation's integrity, as malicious actors could propagate false information across interconnected Misskey instances.
The mitigation strategy for this vulnerability requires implementing proper context sharing between signature verification and compaction operations while ensuring that cryptographic operations are performed in a consistent timing environment. Version 2026.5.4 addresses this issue by synchronizing the JSON-LD parsing context throughout the entire validation lifecycle, eliminating the temporal gap that enabled the timing attack. Organizations deploying Misskey should also consider implementing constant-time cryptographic operations and proper input sanitization to prevent similar vulnerabilities in other components. This remediation aligns with security best practices outlined in CWE-374 and addresses ATT&CK techniques related to credential access and privilege escalation through timing-based information leakage.
This vulnerability demonstrates the importance of maintaining consistent state information across cryptographic verification processes, particularly in distributed systems where trust relationships depend on proper validation mechanisms. The flaw serves as a reminder that even seemingly minor architectural decisions regarding context management can create significant security weaknesses. Security practitioners should be aware of similar issues in other JSON-LD implementations and consider implementing comprehensive timing attack mitigations when dealing with cryptographic operations that may expose timing information to attackers. The fix implemented in version 2026.5.4 represents a proper resolution that ensures the integrity of the verification process by maintaining consistent context throughout all phases of the JSON-LD processing workflow.