What is the CVSS score of CVE-2026-28432?

CVE-2026-28432 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Misskey are affected by CVE-2026-28432?

A cryptographic signature verification flaw in Misskey federated social media platform versions up to 2026.3.1 allows attackers to forge or bypass authentication mechanisms, potentially enabling…

How to fix or mitigate CVE-2026-28432?

Within 24 hours: Inventory all Misskey instances in use and confirm affected versions; enable enhanced logging for authentication and federation events. Within 7 days: Implement network-level monitoring for suspicious federation traffic; restrict federation connections to trusted instances only; disable public federation if operationally feasible. Within 30 days: Monitor vendor advisories for patch availability; prepare deployment plan for emergency patching; conduct security audit of federated connections and user account activity for indicators of compromise.

Misskey CVE-2026-28432

HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-03-10 security-advisories@github.com

Authentication Bypass Misskey

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 07:43 nvd

HIGH 7.5

DescriptionGitHub Advisory

Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1.

AnalysisAI

federated social media platform. All Misskey server versions up to 2026.3.1 is affected by improper verification of cryptographic signature.

Technical ContextAI

This vulnerability (CWE-347: Improper Verification of Cryptographic Signature) affects federated social media platform. All Misskey server. Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1.