{"id":"CVE-2026-47746","summary":"Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks","details":"Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and subsequent processing, the application may trust information that should not be trusted, resulting in a time-of-check to time-of-use (TOCTOU) flaw. This allows an attacker to have fraudulent activities accepted as valid, leading to a loss of integrity. This issue has been fixed in version 2026.5.4.","aliases":["GHSA-38jx-423m-g387"],"modified":"2026-08-07T11:49:55.333651088Z","published":"2026-08-03T21:56:40.198Z","database_specific":{"cwe_ids":["CWE-367"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47746.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/misskey-dev/misskey/releases/tag/2026.5.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47746.json"},{"type":"ADVISORY","url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-38jx-423m-g387"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47746"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/misskey-dev/misskey","events":[{"introduced":"4ea60d36e5725aad51a1b75ba9ea4fc40db75faa"},{"fixed":"4aa1d9ffc851a7824cb72b84ec01c3f65613463c"}],"database_specific":{"extracted_events":[{"introduced":"12.37.0"},{"fixed":"2026.5.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2026.5.4-beta.0","2026.5.4-alpha.0","2026.5.3","2026.5.3-alpha.0","2026.5.2","2026.5.2-beta.1","2026.5.2-beta.0","2026.5.2-alpha.0","2026.5.1","2026.5.1-beta.0","2026.5.1-alpha.0","2026.5.0","2026.5.0-alpha.0","2026.4.0-beta.2","2026.4.0-beta.1","2026.4.0-beta.0","2026.4.0-alpha.6","2026.4.0-alpha.5","2026.4.0-alpha.4","2026.4.0-alpha.3","2026.4.0-alpha.2","2026.4.0-alpha.1","2026.4.0-alpha.0","2026.3.2","2026.3.2-beta.0","2026.3.2-alpha.2","2026.3.2-alpha.1","2026.3.2-alpha.0","2026.3.1","2026.3.1-alpha.0","2026.3.0","2026.3.0-alpha.0","2026.2.0-beta.0","2026.2.0-alpha.0","2026.1.0-beta.0","2026.1.0-alpha.4","2026.1.0-alpha.3","2026.1.0-alpha.2","2026.1.0-alpha.1","2026.1.0-alpha.0","2025.12.2","2025.12.2-beta.4","2025.12.2-beta.3","2025.12.2-beta.2","2025.12.2-alpha.0","2025.12.1","2025.12.1-alpha.1","2025.12.1-alpha.0","2025.12.0","2025.12.0-beta.0","2025.12.0-alpha.2","2025.12.0-alpha.1","2025.12.0-alpha.0","2025.11.2-alpha.4","2025.11.2-alpha.3","2025.11.2-alpha.2","2025.11.2-alpha.1","2025.11.2-alpha.0","2025.11.1","2025.11.1-beta.3","2025.11.1-beta.2","2025.11.1-beta.1","2025.11.1-beta.0","2025.11.1-alpha.2","2025.11.1-alpha.1","2025.11.1-alpha.0","2025.11.0","2025.11.0-rc.0","2025.11.0-beta.0","2025.11.0-alpha.4","2025.11.0-alpha.3","2025.11.0-alpha.2","2025.11.0-alpha.1","2025.11.0-alpha.0","2025.10.2","2025.10.2-beta.0","2025.10.2-alpha.0","2025.10.1","2025.10.1-beta.4","2025.10.1-beta.2","2025.10.1-beta.1","2025.10.1-beta.0","2025.10.1-alpha.6","2025.10.1-alpha.5","2025.10.1-alpha.4","2025.10.1-alpha.2","2025.10.1-alpha.1","2025.10.1-alpha.0","2025.10.0","2025.10.0-beta.2","2025.10.0-beta.1","2025.10.0-beta.0","2025.10.0-alpha.0","2025.9.1-alpha.2","2025.9.1-alpha.1","2025.9.1-alpha.0","2025.9.0","2025.9.0-rc.0","2025.9.0-beta.1","2025.9.0-beta.0","2025.9.0-alpha.2","2025.9.0-alpha.1","2025.9.0-alpha.0","2025.8.0","2025.8.0-rc.0","2025.8.0-beta.6","2025.8.0-beta.5","2025.8.0-beta.4","2025.8.0-beta.3","2025.8.0-beta.2","2025.8.0-beta.1","2025.8.0-beta.0","2025.8.0-alpha.13","2025.8.0-alpha.12","2025.8.0-alpha.11","2025.8.0-alpha.9","2025.8.0-alpha.8","2025.8.0-alpha.7","2025.8.0-alpha.6","2025.8.0-alpha.5","2025.8.0-alpha.4","2025.8.0-alpha.3","2025.8.0-alpha.2","2025.8.0-alpha.1","2025.8.0-alpha.0","2025.7.0","2025.7.0-rc.1","2025.7.0-rc.0","2025.7.0-beta.2","2025.7.0-beta.1","2025.7.0-alpha.0","2025.6.4-alpha.4","2025.6.4-alpha.3","2025.6.4-alpha.2","2025.6.4-alpha.1","2025.6.4-alpha.0","2025.6.3","2025.6.3-alpha.0","2025.6.2","2025.6.2-alpha.0","2025.6.1","2025.6.1-rc.0","2025.6.1-beta.2","2025.6.1-beta.1","2025.6.1-beta.0","2025.6.1-alpha.4","2025.6.1-alpha.2","2025.6.1-alpha.1","2025.6.1-alpha.0","2025.6.0","2025.6.0-beta.1","2025.6.0-beta.0","2025.6.0-alpha.0","2025.5.1","2025.5.1-beta.6","2025.5.1-beta.5","2025.5.1-beta.4","2025.5.1-beta.3","2025.5.1-beta.2","2025.5.1-beta.1","2025.5.1-alpha.5","2025.5.1-alpha.4","2025.5.1-alpha.3","2025.5.1-alpha.2","2025.5.1-alpha.1","2025.5.1-alpha.0","2025.5.0","2025.5.0-rc.0","2025.5.0-beta.0","2025.5.0-alpha.2","2025.5.0-alpha.1","2025.5.0-alpha.0","2025.4.1","2025.4.1-rc.0","2025.4.1-beta.9","2025.4.1-beta.8","2025.4.1-beta.7","2025.4.1-beta.6","2025.4.1-beta.2","2025.4.1-beta.0","2025.4.1-alpha.2","2025.4.1-alpha.1","2025.4.1-alpha.0","2025.4.0","2025.4.0-rc.5","2025.4.0-rc.4","2025.4.0-rc.0","2025.4.0-beta.1","2025.4.0-beta.0","2025.4.0-alpha.0","2025.3.2-beta.21","2025.3.2-beta.20","2025.3.2-beta.19","2025.3.2-beta.17","2025.3.2-beta.15","2025.3.2-beta.14","2025.3.2-beta.13","2025.3.2-beta.12","2025.3.2-beta.11","2025.3.2-beta.10","2025.3.2-beta.9","2025.3.2-beta.8","2025.3.2-beta.5","2025.3.2-beta.4","2025.3.2-beta.2","2025.3.2-beta.1","2025.3.2-beta.0","2025.3.2-alpha.11","2025.3.2-alpha.10","2025.3.2-alpha.8","2025.3.2-alpha.4","2025.3.2-alpha.3","2025.3.2-alpha.2","2025.3.2-alpha.1","2025.3.1","2025.3.1-beta.3","2025.3.1-beta.2","2025.3.1-beta.1","2025.3.1-beta.0","2025.3.1-alpha.0","2025.3.0","2025.3.0-beta.2","2025.3.0-beta.1","2025.3.0-beta.0","2025.3.0-alpha.0","2025.2.1","2025.2.1-beta.2","2025.2.1-beta.1","2025.2.1-beta.0","2025.2.1-alpha.0","2025.2.0","2025.2.0-beta.1","2025.2.0-beta.0","2025.2.0-alpha.0","2025.1.0","2025.1.0-beta.3","2025.1.0-beta.2","2025.1.0-beta.1","2025.1.0-beta.0","2025.1.0-alpha.0","2024.11.0","2024.11.0-beta.4","2024.11.0-alpha.3","2024.11.0-alpha.2","2024.11.0-alpha.1","2024.10.2-alpha.2","2024.10.2-alpha.1","2024.10.2-alpha.0","2024.10.1","2024.10.1-beta.6","2024.10.1-beta.5","2024.10.1-beta.4","2024.10.1-beta.3","2024.10.1-beta.2","2024.10.1-beta.1","2024.10.1-alpha.0","2024.10.0","2024.10.0-beta.6","2024.10.0-beta.5","2024.10.0-beta.4","2024.10.0-beta.3","2024.10.0-beta.2","2024.10.0-alpha.1","2024.10.0-alpha.0","2024.9.0","2024.9.0-beta.14","2024.9.0-alpha.13","2024.9.0-alpha.12","2024.9.0-alpha.11","2024.9.0-alpha.10","2024.9.0-alpha.9","2024.9.0-alpha.8","2024.9.0-alpha.7","2024.9.0-alpha.6","2024.9.0-alpha.5","2024.9.0-alpha.4","2024.9.0-alpha.3","2024.9.0-alpha.2","2024.9.0-alpha.1","2024.9.0-alpha.0","2024.8.0","2024.8.0-rc.5","2024.8.0-rc.4","2024.8.0-rc.3","2024.8.0-beta.2","2024.8.0-alpha.1","2024.8.0-alpha.0","2024.7.0","2024.7.0-rc.8","2024.7.0-rc.7","2024.7.0-rc.6","2024.7.0-rc.5","2024.7.0-rc.4","2024.7.0-beta.3","2024.7.0-beta.2","2024.7.0-beta.1","2024.7.0-beta.0","2024.2.0-beta.13","2024.2.0-beta.12","2024.2.0-beta.10","2024.2.0-beta.9","2024.2.0-beta.8","2024.2.0-beta.7","2024.2.0-beta.6","2024.2.0-beta.5","2024.2.0-beta.4","2024.2.0-beta.3","2024.2.0-beta.2","2024.2.0-beta.1","2023.12.0-beta.6","2023.12.0-beta.5","2023.12.0-beta.4","2023.12.0-beta.3","2023.12.0-beta.2","2023.12.0-beta.1","2023.11.1-beta.2","2023.11.1-beta.1","2023.11.0-beta.10","2023.11.0-beta.9","2023.11.0-beta.8","2023.11.0-beta.7","2023.11.0-beta.6","2023.11.0-beta.5","2023.11.0-beta.4","2023.11.0-beta.3","2023.11.0-beta.2","2023.11.0-beta.1","2023.10.2-beta.2","2023.10.2-beta.1","2023.10.0-beta.15","2023.10.0-beta.14","2023.10.0-beta.13","2023.10.0-beta.12","2023.10.0-beta.11","2023.10.0-beta.10","2023.10.0-beta.9","2023.10.0-beta.8","2023.10.0-beta.7","2023.10.0-beta.6","2023.10.0-beta.5","2023.10.0-beta.4","2023.10.0-beta.3","2023.10.0-beta.2","2023.10.0-beta.1","2023.9.0-rc.4","2023.9.0-rc.3","2023.9.0-rc.2","2023.9.0-rc.1","2023.9.0-beta.11","2023.9.0-beta.10","2023.9.0-beta.9","2023.9.0-beta.8","2023.9.0-beta.7","2023.9.0-beta.6","2023.9.0-beta.5","2023.9.0-beta.4","2023.9.0-beta.3","2023.9.0-beta.2","2023.9.0-beta.1","13.14.0-beta.7","13.14.0-beta.6","13.14.0-beta.5","13.14.0-beta.4","13.14.0-beta.3","13.14.0-beta.2","13.14.0-beta.1","13.13.0-beta.7","13.13.0-beta.6","13.13.0-beta.5","13.13.0-beta.4","13.13.0-beta.3","13.13.0-beta.2","13.13.0-beta.1","13.12.0-beta.6","13.12.0-beta.5","13.12.0-beta.4","13.12.0-beta.3","13.12.0-beta.2","13.11.0-beta.8","13.11.0-beta.7","13.11.0-beta.6","13.11.0-beta.4","13.11.0.beta-3","13.11.0.beta-2","13.11.0.beta-1","13.0.0-rc.11","13.0.0-rc.10","13.0.0-rc.9","13.0.0-rc.8","13.0.0-rc.7","13.0.0-rc.6","13.0.0-rc.5","13.0.0-rc.3","13.0.0-rc.2","13.0.0-rc.1","13.0.0-beta.43","13.0.0-beta.42","13.0.0-beta.41","13.0.0-beta.40","13.0.0-beta.39","13.0.0-beta.38","13.0.0-beta.37","13.0.0-beta.36","13.0.0-beta.35","13.0.0-beta.34","13.0.0-beta.33","13.0.0-beta.32","13.0.0-beta.31","13.0.0-beta.30","13.0.0-beta.29","13.0.0-beta.28","13.0.0-beta.27","13.0.0-beta.26","13.0.0-beta.25","13.0.0-beta.24","13.0.0-beta.23","13.0.0-beta.22","13.0.0-beta.21","13.0.0-beta.16","12.67.1","12.67.0","12.66.0","12.65.7","12.65.6","12.65.5","12.65.4","12.65.3","12.65.2","12.65.1","12.65.0","12.64.2","12.64.1","12.64.0","12.63.0","12.62.2","12.62.1","12.62.0","12.61.1","12.61.0","12.60.1","12.60.0","12.59.0","12.58.0","12.57.4","12.57.1","12.57.0","12.56.0","12.55.0","12.54.0","12.53.0","12.52.0","12.51.0","12.50.0","12.49.1","12.49.0","12.48.3","12.48.2","12.48.1","12.48.0","12.47.1","12.47.0","12.46.0","12.45.1","12.45.0","12.44.1","12.44.0","12.43.0","12.42.0","12.41.3","12.41.2","12.41.1","12.41.0","12.40.0","12.39.1","12.39.0","12.38.1","12.38.0","12.37.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47746.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"}]}