CVE-2025-54888

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-54888
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54888.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54888
Aliases
Published
2025-08-09T01:31:53.319Z
Modified
2026-04-10T05:29:42.418407Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
@fedify/fedify: Improper Authentication and Incorrect Authorization
Details

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.

Database specific 
{
    "cwe_ids": [
        "CWE-287",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54888.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/fedify-dev/fedify

Affected ranges

Type
GIT
Repo
https://github.com/fedify-dev/fedify
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e1589833f455e7945d77dbca4f3d6fcdd6132b1b

Affected versions

0.*
0.1.0
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.15.0
0.2.0
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.8.0
0.9.0
1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.1
1.7.0
1.8.1
1.8.2
1.8.3
1.8.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54888.json"