PT-2025-32420 · Fedify · Fedify
Allouis
·
Publicado
2025-08-08
·
Atualizado
2026-02-04
·
CVE-2025-54888
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Fedify versions prior to 1.3.20
Fedify versions 1.4.0-dev.585 through 1.4.12
Fedify versions 1.5.0-dev.636 through 1.5.4
Fedify versions 1.6.0-dev.754 through 1.6.7
Fedify versions 1.7.0-pr.251.885 through 1.7.8
Fedify versions 1.8.0-dev.909 through 1.8.4
Description
An authentication bypass vulnerability allows an unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. The vulnerability exists in the
handleInboxInternal function in fedify/federation/handler.ts, where activity processing occurs before authentication checks. Specifically, the routeActivity() function is called before the doesActorOwnKey() authentication check. This allows malicious activities to be processed even with a key mismatch.Recommendations
Update to Fedify version 1.3.20 or later.
Update to Fedify version 1.4.13 or later.
Update to Fedify version 1.5.5 or later.
Update to Fedify version 1.6.8 or later.
Update to Fedify version 1.7.9 or later.
Update to Fedify version 1.8.5 or later.
Exploit
Correção
Incorrect Authorization
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Fedify