CVE-2026-47746

Name of the Vulnerable Software and Affected Versions Misskey versions 12.37.0 through 2026.5.3

Description Misskey is an open source, federated social media platform. The software is susceptible to timing attacks during the compaction process and JSON-LD signature validation. A time-of-check to time-of-use (TOCTOU) flaw occurs because the JSON-LD parsing context is not shared between signature verification and subsequent processing. This allows an attacker to bypass integrity checks and have fraudulent activities accepted as valid.

Recommendations Update to version 2026.5.4.