Misskey versions released before 2026.3.1 fail to properly validate HTTP signatures that secure federated communications. This flaw allows an attacker to forge or manipulate federated requests, causing the server to accept these requests as authentic. The consequence is that the compromised server could be tricked into processing malicious content or impersonating other instances, leading to integrity violations and potential misuse of user data.

All Misskey installations operated by misskey-dev, specifically any server running a version earlier than 2026.3.1. The issue is independent of whether federation is enabled, so every server running the affected code base is susceptible.

The CVSS score for this vulnerability is 7.1, indicating a high level of severity. The EPSS score is less than 1%, suggesting that exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote; an adversary can send forged signed federation messages that bypass the signature check, enabling unauthorized data injection or impersonation of other instances.