CVE-2026-28432

Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1.

• CWE-347

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-grwc-c762-gcvpVendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28426Statmatic is a Laravel and Git powered content management sy…5.4
• CVE-2026-28427OpenDeck is Linux software for your Elgato Stream Deck. Prio…7.5
• CVE-2026-28428Talishar is a fan-made Flesh and Blood project. Prior to com…5.3
• CVE-2026-28429Talishar is a fan-made Flesh and Blood project. Prior to com…7.5
• CVE-2026-28430Chamilo LMS is a learning management system. Prior to versio…9.8
• CVE-2026-28431Misskey is an open source, federated social media platform. …7.5
• CVE-2026-28433Misskey is an open source, federated social media platform. …4.3
• CVE-2026-28434cpp-httplib is a C++11 single-file header-only cross platfor…5.3
• CVE-2026-28435cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-28436Frappe is a full-stack web application framework. Prior to v…7.2
• CVE-2026-28438CocoIndex is a data transformation framework for AI. Prior t…9.8
• CVE-2026-2844Missing Authentication for Critical Function vulnerability i…7.5