CVE-2026-46713: Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
misskeyto a version that resolves this vulnerability.Fixed in 2026.5.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46713?
CVE-2026-46713 has a risk score of 55.
How do I fix CVE-2026-46713?
To fix CVE-2026-46713, upgrade Misskey to version 2026.5.4 or later.
What impact does CVE-2026-46713 have on Misskey?
CVE-2026-46713 can allow spoofed activities to be accepted as valid, compromising activity handling.
Which versions of Misskey are affected by CVE-2026-46713?
Misskey versions 12.37.0 and later, but before 2026.5.4, are affected by CVE-2026-46713.
When was CVE-2026-46713 published?
CVE-2026-46713 was published on August 3, 2026.