Vulnerability-Lookup

CVE-2025-54888 (GCVE-0-2025-54888)

Vulnerability from cvelistv5 – Published: 2025-08-09 01:31 – Updated: 2026-02-04 22:13

Title

@fedify/fedify: Improper Authentication and Incorrect Authorization

Summary

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-11 13:48 UTC

CWE

CWE-287 - Improper Authentication
CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/fedify-dev/fedify/security/adv…	x_refsource_CONFIRM
https://github.com/fedify-dev/fedify/commit/14a2f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
fedify-dev	fedify	Affected: < 1.3.20 Affected: >= 1.4.0-dev.585, < 1.4.13 Affected: >= 1.5.0-dev.636, < 1.5.5 Affected: >= 1.6.0-dev.754, < 1.6.8 Affected: >= 1.7.0-pr.251.885, < 1.7.9 Affected: >= 1.8.0-dev.909, < 1.8.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54888",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T13:48:34.676198Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-11T13:48:53.546Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.4.0-dev.585, \u003c 1.4.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.0-dev.636, \u003c 1.5.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.0-dev.754, \u003c 1.6.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0-pr.251.885, \u003c 1.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-dev.909, \u003c 1.8.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T22:13:48.899Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847"
        }
      ],
      "source": {
        "advisory": "GHSA-6jcc-xgcr-q3h4",
        "discovery": "UNKNOWN"
      },
      "title": "@fedify/fedify: Improper Authentication and Incorrect Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54888",
    "datePublished": "2025-08-09T01:31:53.319Z",
    "dateReserved": "2025-07-31T17:23:33.476Z",
    "dateUpdated": "2026-02-04T22:13:48.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-54888",
      "date": "2026-11-13",
      "epss": "0.00672",
      "percentile": "0.52645"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "fedify",
                "vendor": "fedify-dev",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.3.20"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.4.0-dev.585, \u003c 1.4.13"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.5.0-dev.636, \u003c 1.5.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.6.0-dev.754, \u003c 1.6.8"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.7.0-pr.251.885, \u003c 1.7.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.8.0-dev.909, \u003c 1.8.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5."
          },
          {
            "lang": "es",
            "value": "Fedify es una librer\u00eda de TypeScript para crear aplicaciones de servidores federados con tecnolog\u00eda ActivityPub. En las versiones anteriores a la 1.3.20, 1.4.0-dev.585 a 1.4.12, 1.5.0-dev.636 a 1.5.4, 1.6.0-dev.754 a 1.6.7, 1.7.0-pr.251.885 a 1.7.8 y 1.8.0-dev.909 a 1.8.4, una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n permite a cualquier atacante no autenticado suplantar la identidad de cualquier actor de ActivityPub mediante el env\u00edo de actividades falsificadas firmadas con sus propias claves. Las actividades se procesan antes de verificar que la clave de firma pertenezca al actor declarado, lo que permite la suplantaci\u00f3n completa del actor en todas las instancias de Fedify. Esto se solucion\u00f3 en las versiones 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 y 1.8.5."
          }
        ],
        "id": "CVE-2025-54888",
        "lastModified": "2026-06-17T09:40:52.337",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-54888",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T13:48:34.676198Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-08-09T02:15:37.737",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              },
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-02-05T01:22:42+00:00",
      "cve": "CVE-2025-54888",
      "id": "CVE-2025-54888",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "@fedify/fedify: Improper Authentication and Incorrect Authorization",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-54888.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-54888",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-08-11T13:48:34.676198Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-08-11T13:48:39.132Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "fedify",
              "vendor": "fedify-dev",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.3.20"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.4.0-dev.585, \u003c 1.4.13"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.5.0-dev.636, \u003c 1.5.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.6.0-dev.754, \u003c 1.6.8"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.7.0-pr.251.885, \u003c 1.7.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.8.0-dev.909, \u003c 1.8.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287: Improper Authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-02-04T22:13:48.899Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4"
            },
            {
              "name": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847"
            }
          ],
          "source": {
            "advisory": "GHSA-6jcc-xgcr-q3h4",
            "discovery": "UNKNOWN"
          },
          "title": "@fedify/fedify: Improper Authentication and Incorrect Authorization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-54888",
        "datePublished": "2025-08-09T01:31:53.319Z",
        "dateReserved": "2025-07-31T17:23:33.476Z",
        "dateUpdated": "2026-02-04T22:13:48.899Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-54888

Vulnerability from fkie_nvd - Published: 2025-08-09 02:15 - Updated: 2026-06-17 09:40

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847
	security-advisories@github.com	https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.4.0-dev.585, \u003c 1.4.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.0-dev.636, \u003c 1.5.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.0-dev.754, \u003c 1.6.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0-pr.251.885, \u003c 1.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-dev.909, \u003c 1.8.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5."
    },
    {
      "lang": "es",
      "value": "Fedify es una librer\u00eda de TypeScript para crear aplicaciones de servidores federados con tecnolog\u00eda ActivityPub. En las versiones anteriores a la 1.3.20, 1.4.0-dev.585 a 1.4.12, 1.5.0-dev.636 a 1.5.4, 1.6.0-dev.754 a 1.6.7, 1.7.0-pr.251.885 a 1.7.8 y 1.8.0-dev.909 a 1.8.4, una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n permite a cualquier atacante no autenticado suplantar la identidad de cualquier actor de ActivityPub mediante el env\u00edo de actividades falsificadas firmadas con sus propias claves. Las actividades se procesan antes de verificar que la clave de firma pertenezca al actor declarado, lo que permite la suplantaci\u00f3n completa del actor en todas las instancias de Fedify. Esto se solucion\u00f3 en las versiones 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 y 1.8.5."
    }
  ],
  "id": "CVE-2025-54888",
  "lastModified": "2026-06-17T09:40:52.337",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54888",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-08-11T13:48:34.676198Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-08-09T02:15:37.737",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6JCC-XGCR-Q3H4

Vulnerability from github – Published: 2025-08-08 14:29 – Updated: 2026-02-04 22:13

Summary

@fedify/fedify has Improper Authentication and Incorrect Authorization

Details

Summary

An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances

Details

The vulnerability exists in handleInboxInternal function in fedify/federation/handler.ts. The critical flaw is in the order of operations:

Line 1712: routeActivity() is called first, which processes the activity (either immediately or by adding to queue)
Line 1730: Authentication check (doesActorOwnKey) happens AFTER processing

  // fedify/federation/handler.ts:1712-1750
  const routeResult = await routeActivity({  // ← Activity processed here
    context: ctx,
    json,
    activity,
    recipient,
    inboxListeners,
    inboxContextFactory,
    inboxErrorHandler,
    kv,
    kvPrefixes,
    queue,
    span,
    tracerProvider,
  });

  if (
    httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)  // ← Auth check too late
  ) {
    // Returns 401, but activity already processed
    return new Response("The signer and the actor do not match.", {
      status: 401,
      headers: { "Content-Type": "text/plain; charset=utf-8" },
    });
  }

By the time the 401 response is returned, the malicious activity has already been processed or queued.

PoC

Create an activity claiming to be from any actor:

  const maliciousActivity = {
    "@context": "https://www.w3.org/ns/activitystreams",
    "type": "Create",
    "actor": "https://victim.example.com/users/alice",  // Impersonating victim
    "object": {
      "type": "Note",
      "content": "This is a forged message!"
    }
  }

Sign the HTTP request with attacker's key (not the victim's):

  // Sign with attacker's key: https://attacker.com/users/eve#main-key
  const signedRequest = await signRequest(request, attackerPrivateKey, attackerKeyId);

Send to any Fedify inbox - the activity will be processed despite the key mismatch.

Impact

Type: Authentication Bypass / Actor Impersonation

Who is impacted: All Fedify instances and their users

Consequences: Allows complete impersonation of any ActivityPub actor, enabling: - Sending fake posts/messages as any user - Creating/removing follows as any user - Boosting/sharing content as any user - Complete compromise of federation trust model

The vulnerability affects all Fedify instances but does not propagate to other ActivityPub implementations (Mastodon, etc.) which properly validate before processing.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0-dev.585"
            },
            {
              "fixed": "1.4.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0-dev.636"
            },
            {
              "fixed": "1.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0-dev.754"
            },
            {
              "fixed": "1.6.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0-pr.251.885"
            },
            {
              "fixed": "1.7.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.8.0-dev.909"
            },
            {
              "fixed": "1.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-08T14:29:48Z",
    "nvd_published_at": "2025-08-09T02:15:37Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances\n\n### Details\nThe vulnerability exists in handleInboxInternal function in fedify/federation/handler.ts. The critical flaw is in the order of operations:\n\n  1. Line 1712: routeActivity() is called first, which processes the activity (either immediately or by adding to queue)\n  2. Line 1730: Authentication check (doesActorOwnKey) happens AFTER processing\n\n```ts\n  // fedify/federation/handler.ts:1712-1750\n  const routeResult = await routeActivity({  // \u2190 Activity processed here\n    context: ctx,\n    json,\n    activity,\n    recipient,\n    inboxListeners,\n    inboxContextFactory,\n    inboxErrorHandler,\n    kv,\n    kvPrefixes,\n    queue,\n    span,\n    tracerProvider,\n  });\n\n  if (\n    httpSigKey != null \u0026\u0026 !await doesActorOwnKey(activity, httpSigKey, ctx)  // \u2190 Auth check too late\n  ) {\n    // Returns 401, but activity already processed\n    return new Response(\"The signer and the actor do not match.\", {\n      status: 401,\n      headers: { \"Content-Type\": \"text/plain; charset=utf-8\" },\n    });\n  }\n```\n\nBy the time the 401 response is returned, the malicious activity has already been processed or queued.\n\n### PoC\n\n  1. Create an activity claiming to be from any actor:\n```ts\n  const maliciousActivity = {\n    \"@context\": \"https://www.w3.org/ns/activitystreams\",\n    \"type\": \"Create\",\n    \"actor\": \"https://victim.example.com/users/alice\",  // Impersonating victim\n    \"object\": {\n      \"type\": \"Note\",\n      \"content\": \"This is a forged message!\"\n    }\n  }\n```\n  2. Sign the HTTP request with attacker\u0027s key (not the victim\u0027s):\n```ts\n  // Sign with attacker\u0027s key: https://attacker.com/users/eve#main-key\n  const signedRequest = await signRequest(request, attackerPrivateKey, attackerKeyId);\n```\n  3. Send to any Fedify inbox - the activity will be processed despite the key mismatch.\n\n### Impact\n\nType: Authentication Bypass / Actor Impersonation\n\nWho is impacted: All Fedify instances and their users\n\nConsequences: Allows complete impersonation of any ActivityPub actor, enabling:\n  - Sending fake posts/messages as any user\n  - Creating/removing follows as any user\n  - Boosting/sharing content as any user\n  - Complete compromise of federation trust model\n\nThe vulnerability affects all Fedify instances but does not propagate to other ActivityPub implementations (Mastodon, etc.) which properly validate before processing.",
  "id": "GHSA-6jcc-xgcr-q3h4",
  "modified": "2026-02-04T22:13:40Z",
  "published": "2025-08-08T14:29:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54888"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fedify-dev/fedify"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@fedify/fedify has Improper Authentication and Incorrect Authorization"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-54888 (GCVE-0-2025-54888)

FKIE_CVE-2025-54888

GHSA-6JCC-XGCR-Q3H4

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour