CVE-2026-28432: Misskey Auth Bypass Vulnerability

CVE-2026-28432 Overview

CVE-2026-28432 is an HTTP signature verification bypass vulnerability affecting Misskey, an open source federated social media platform. This authentication bypass vulnerability allows attackers to circumvent the HTTP signature verification mechanism that protects server-to-server communication in the ActivityPub federation protocol. Although this vulnerability is related to federation functionality, it critically affects all Misskey servers regardless of whether federation is enabled or disabled.

Critical Impact

Attackers can bypass HTTP signature verification on any Misskey server prior to version 2026.3.1, potentially allowing spoofed or malicious federation requests to be processed as legitimate, compromising the integrity of federated content.

Affected Products

• Misskey servers prior to version 2026.3.1
• All Misskey instances regardless of federation configuration
• Self-hosted and managed Misskey deployments running vulnerable versions

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-28432 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28432

Vulnerability Analysis

This vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature), indicating a fundamental flaw in how Misskey validates HTTP signatures during federation requests. HTTP Signature verification is a critical security control in the ActivityPub protocol that federated platforms like Misskey use to authenticate requests between servers.

The vulnerability exists in the signature verification logic and affects the integrity of all incoming federation requests. When exploited, an attacker could forge requests that appear to originate from legitimate federated servers, potentially allowing unauthorized content injection, user impersonation across the fediverse, or manipulation of federated activities.

The network-accessible nature of this vulnerability means any Misskey server exposed to the internet is potentially at risk, with no authentication required for exploitation. The attack does require some user interaction component, but successful exploitation results in high integrity impact to the affected system.

Root Cause

The root cause of this vulnerability stems from improper verification of cryptographic signatures in HTTP requests. Misskey's federation implementation failed to properly validate the HTTP Signature headers used in server-to-server communication, allowing malformed or spoofed signatures to pass verification checks. This cryptographic verification failure undermines the trust model that federated social media platforms rely upon for secure inter-server communication.

Attack Vector

The attack can be executed remotely over the network against any vulnerable Misskey instance. An attacker would craft malicious HTTP requests with manipulated signature headers targeting the federation endpoints of a Misskey server. Since the signature verification can be bypassed, these requests would be processed as if they came from a trusted federated server.

The attack flow involves:

1. Identifying a target Misskey server running a version prior to 2026.3.1
2. Crafting ActivityPub federation requests with malformed or invalid HTTP signatures
3. Sending these requests to the target server's federation inbox endpoint
4. The server incorrectly accepts the requests due to the verification bypass
5. Malicious content or activities are processed as legitimate federated data

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-28432

Indicators of Compromise

• Unusual federation activity from unknown or suspicious remote servers
• Unexpected content appearing on timelines that doesn't match legitimate federation patterns
• Log entries showing federation requests with malformed or missing signature headers being accepted
• Anomalous user activities attributed to federated accounts that appear inconsistent with normal behavior

Detection Strategies

• Monitor federation endpoint logs for requests with invalid or suspicious HTTP Signature headers
• Implement anomaly detection for unusual patterns in incoming ActivityPub requests
• Review server logs for federation requests from unexpected source IP addresses or domains
• Deploy web application firewalls with rules to detect malformed HTTP Signature patterns

Monitoring Recommendations

• Enable detailed logging for all federation-related endpoints and signature verification processes
• Set up alerts for spikes in federation request failures or signature validation anomalies
• Monitor the inbox and federation endpoints for unusual request volumes or patterns
• Implement network traffic analysis to detect potential exploitation attempts against ActivityPub endpoints

How to Mitigate CVE-2026-28432

Immediate Actions Required

• Upgrade all Misskey instances to version 2026.3.1 or later immediately
• Review recent federation activity logs for signs of exploitation prior to patching
• Consider temporarily restricting federation if immediate patching is not possible
• Audit content that arrived via federation since the server was deployed to identify potentially malicious entries

Patch Information

The vulnerability has been fixed in Misskey version 2026.3.1. Administrators should upgrade their Misskey installations to this version or later to remediate the vulnerability. The fix addresses the HTTP signature verification bypass by implementing proper cryptographic signature validation for all federation requests.

For official patch details and release information, see the GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, consider temporarily disabling federation functionality until the patch can be applied
• Implement network-level filtering to restrict incoming federation requests to known trusted servers only
• Deploy a reverse proxy with additional request validation to filter suspicious federation requests
• Monitor federation endpoints closely for exploitation attempts while preparing for upgrade

# Configuration example
# Upgrade Misskey to patched version
cd /path/to/misskey
git fetch origin
git checkout 2026.3.1
pnpm install
pnpm run build
pnpm run migrate
# Restart Misskey service
systemctl restart misskey