PT-2025-32420 · Fedify · Fedify

Allouis

·

Published

2025-08-08

·

Updated

2026-02-04

·

CVE-2025-54888

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Fedify versions prior to 1.3.20 Fedify versions 1.4.0-dev.585 through 1.4.12 Fedify versions 1.5.0-dev.636 through 1.5.4 Fedify versions 1.6.0-dev.754 through 1.6.7 Fedify versions 1.7.0-pr.251.885 through 1.7.8 Fedify versions 1.8.0-dev.909 through 1.8.4
Description An authentication bypass vulnerability allows an unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. The vulnerability exists in the handleInboxInternal function in fedify/federation/handler.ts, where activity processing occurs before authentication checks. Specifically, the routeActivity() function is called before the doesActorOwnKey() authentication check. This allows malicious activities to be processed even with a key mismatch.
Recommendations Update to Fedify version 1.3.20 or later. Update to Fedify version 1.4.13 or later. Update to Fedify version 1.5.5 or later. Update to Fedify version 1.6.8 or later. Update to Fedify version 1.7.9 or later. Update to Fedify version 1.8.5 or later.

Exploit

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863CWE-287

Related Identifiers

CVE-2025-54888
GHSA-6JCC-XGCR-Q3H4

Affected Products

Fedify