CVE-2025-54888: Fedify ActivityPub Auth Bypass Flaw

CVE-2025-54888 Overview

CVE-2025-54888 is an authentication bypass vulnerability in Fedify, a TypeScript library for building federated server applications powered by ActivityPub. The flaw allows any unauthenticated attacker to impersonate arbitrary ActivityPub actors by sending forged activities signed with attacker-controlled keys. Fedify processes incoming activities before verifying that the signing key actually belongs to the claimed actor, which permits complete actor impersonation across all Fedify-based instances. The vulnerability is tracked under CWE-287: Improper Authentication.

Critical Impact

Unauthenticated attackers can impersonate any ActivityPub actor across the federated network, compromising integrity of every Fedify instance until patched.

Affected Products

• Fedify versions below 1.3.20
• Fedify 1.4.0-dev.585 through 1.4.12, and 1.5.0-dev.636 through 1.5.4
• Fedify 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8, and 1.8.0-dev.909 through 1.8.4

Discovery Timeline

• 2025-08-09 - CVE-2025-54888 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54888

Vulnerability Analysis

Fedify implements ActivityPub federation, which relies on HTTP Signatures to authenticate inbound activities between servers. Each activity carries a signature generated with the sender's private key, and recipients must validate that the signature, the signing key, and the claimed actor identity are all consistent. In affected versions, Fedify reverses the expected validation order: it processes the incoming activity and accepts the actor identity declared in the payload before confirming that the signing key is authoritative for that actor.

This ordering flaw means an attacker can generate a fresh key pair, publish it under an attacker-controlled actor document, and then sign activities that claim to originate from any other actor in the fediverse. Because the signature itself is mathematically valid against the attacker's own key, Fedify treats the activity as authentic before it ever checks key ownership. The result is full actor impersonation without credentials, prior access, or user interaction.

Root Cause

The root cause is improper authentication logic [CWE-287] in the inbound activity handler. The verification routine confirms only that the activity carries a cryptographically valid signature, not that the key used to produce the signature is bound to the actor identified in the activity. The trust relationship between actor and signing key is never enforced before processing.

Attack Vector

Exploitation is remote, network-based, and requires no authentication or user interaction. An attacker hosts an ActivityPub actor on infrastructure they control, generates a key pair for that actor, and then sends forged Create, Follow, Announce, Delete, or other activities to a target Fedify inbox. The actor field in the payload references a victim identity, while the HTTP Signature header references the attacker's key. Vulnerable Fedify instances process the activity as if the victim had sent it.

No verified public exploit code is published. Technical details are available in the GitHub Security Advisory GHSA-6jcc-xgcr-q3h4 and the upstream patch commit.

Detection Methods for CVE-2025-54888

Indicators of Compromise

• Inbound ActivityPub requests where the HTTP Signature keyId resolves to a domain that does not match the actor URI in the request body.
• Federation logs showing activities attributed to remote actors that were processed without successful key-ownership validation.
• Sudden spikes in Follow, Announce, or Delete activities originating from previously unseen instances or newly registered domains.

Detection Strategies

• Inspect Fedify inbox handler logs for activities where the signing key host differs from the actor host and flag them for review.
• Correlate ActivityPub signature keyId values with the publicKey field of the corresponding actor document to confirm binding.
• Audit federation history for impersonation patterns such as the same actor appearing with multiple unrelated signing keys over time.

Monitoring Recommendations

• Forward Fedify application logs and reverse-proxy access logs to a central analytics platform for retrospective hunting.
• Alert on HTTP POST requests to /inbox and /users/*/inbox endpoints from unfamiliar source domains following the patch window.
• Monitor for outbound moderation actions, deletions, or follow events that were not initiated by the authentic local user.

How to Mitigate CVE-2025-54888

Immediate Actions Required

• Upgrade Fedify to a fixed release: 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, or 1.8.5.
• Audit federation logs from before the patch was applied for activities that may have been processed under a forged identity.
• Rotate or invalidate any state changes (follows, blocks, deletions) that cannot be verified as legitimate user actions.

Patch Information

The maintainers fixed the issue by enforcing key-ownership verification before processing activities. The corrective change is published in the upstream commit 14a2f8c6 and described in GHSA-6jcc-xgcr-q3h4. Operators should redeploy with one of the patched versions listed above.

Workarounds

• No supported workaround exists; upgrading to a fixed Fedify release is required.
• As a temporary risk-reduction measure, restrict federation to a trusted allow-list of known instances at the reverse proxy.
• Disable public inbox endpoints if the application can operate in an isolated mode until the upgrade is deployed.

# Configuration example: upgrade Fedify to a patched version
npm install @fedify/fedify@1.8.5
# Or, for other release lines:
# npm install @fedify/fedify@1.3.20
# npm install @fedify/fedify@1.4.13
# npm install @fedify/fedify@1.5.5
# npm install @fedify/fedify@1.6.8
# npm install @fedify/fedify@1.7.9