Log in Start free

Vulnerability · Published Aug 9, 2025 · Assigned by GitHub_M

CVE-2025-54888@fedify/fedify: Improper Authentication and Incorrect Authorization

High 8.7

In plain English

A high-severity improper authentication in fedify from fedify-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.6%top 48.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@fedify/fedify1.3.20GHSA-6jcc-xgcr-q3h4
npm@fedify/fedify1.4.13GHSA-6jcc-xgcr-q3h4
npm@fedify/fedify1.5.5GHSA-6jcc-xgcr-q3h4
npm@fedify/fedify1.6.8GHSA-6jcc-xgcr-q3h4
npm@fedify/fedify1.7.9GHSA-6jcc-xgcr-q3h4
npm@fedify/fedify1.8.5GHSA-6jcc-xgcr-q3h4

Affected products (as reported)

VendorProductVersions
fedify-dev fedify < 1.3.20>= 1.4.0-dev.585, < 1.4.13>= 1.5.0-dev.636, < 1.5.5>= 1.6.0-dev.754, < 1.6.8>= 1.7.0-pr.251.885, < 1.7.9>= 1.8.0-dev.909, < 1.8.5

Weakness: CWE-287, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References