CVE-2025-54888: Fedify ActivityPub Auth Bypass Flaw

CVE-2025-54888 Overview

CVE-2025-54888 is an authentication bypass vulnerability in Fedify, a TypeScript library for building federated server applications powered by ActivityPub. The flaw allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with attacker-controlled keys. The root cause is that Fedify processes incoming activities before verifying that the signing key belongs to the claimed actor. This logic gap enables complete actor impersonation across all Fedify instances on the federated network. The issue is tracked under [CWE-287: Improper Authentication] and is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, and 1.8.5.

Critical Impact
Unauthenticated attackers can impersonate arbitrary ActivityPub actors across all Fedify-powered federated services, undermining trust in every inbound activity.

Affected Products

Fedify versions below 1.3.20
Fedify 1.4.0-dev.585 through 1.4.12, and 1.5.0-dev.636 through 1.5.4
Fedify 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8, and 1.8.0-dev.909 through 1.8.4

Discovery Timeline

2025-08-09 - CVE-2025-54888 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54888

Vulnerability Analysis

Fedify implements an ActivityPub inbox handler that receives signed activities from remote servers. Each activity should be verified by checking that the HTTP signature key belongs to the actor claimed in the activity payload. In affected versions, the inbox handler routed and processed the activity before performing this ownership check. The check existed in the code path but ran too late to prevent the impersonation. As a result, an attacker can sign an activity with any key they control and place any actor URI in the activity body. Downstream consumers — followers, timelines, moderation tools — treat the forged activity as authentic, enabling impersonation of any remote actor.

Root Cause

The vulnerability is an ordering flaw in src/federation/handler.ts. The function routeActivity was invoked before doesActorOwnKey validated the relationship between the HTTP signature key and the activity's claimed actor. Authorization decisions therefore occurred after side effects from activity processing had already executed.

Attack Vector

An unauthenticated remote attacker sends an HTTP POST to a Fedify instance inbox endpoint. The request carries a valid HTTP signature using a key the attacker owns, while the activity JSON references a victim actor URI. Because no prior authentication is required and the network is the only access requirement, exploitation can be performed at scale across the fediverse.

typescript

     span.setAttribute("activitypub.activity.id", activity.id.href);
   }
   span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
-  const routeResult = await routeActivity({
-    context: ctx,
-    json,
-    activity,
-    recipient,
-    inboxListeners,
-    inboxContextFactory,
-    inboxErrorHandler,
-    kv,
-    kvPrefixes,
-    queue,
-    span,
-    tracerProvider,
-  });
   if (
     httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)
   ) {

Source: GitHub commit 14a2f8c. The patch removes the early call to routeActivity so that the doesActorOwnKey check executes first and rejects forged activities before any processing occurs.

Detection Methods for CVE-2025-54888

Indicators of Compromise

Inbox POST requests where the HTTP signature keyId resolves to a domain different from the activity's actor field.
Repeated inbound activities from remote actors that the local instance has never federated with before, especially Follow, Create, or Announce types.
Spikes in activity processing errors or signature ownership failures in Fedify logs after upgrading to a patched version.

Detection Strategies

Parse inbox access logs and compare the signing key's host with the activity actor's host for every inbound request.
Enable verbose logging in the federation handler and alert on any activity that would have been processed prior to ownership validation.
Cross-reference remote actor identifiers against historical federation data to surface first-seen impersonation attempts.

Monitoring Recommendations

Centralize Fedify application logs and HTTP access logs into a SIEM for correlation across instances.
Monitor for outbound moderation actions, profile changes, or follow relationships that originate from suspicious inbound activities.
Track the deployment status of patched Fedify versions across all federated services in your environment.

How to Mitigate CVE-2025-54888

Immediate Actions Required

Upgrade Fedify to 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, or 1.8.5 depending on the release branch in use.
Audit inbox processing logs for activities received before the upgrade where the signing key host does not match the actor host.
Notify federated peers and users if impersonation activity is identified during the audit.

Patch Information

The fix is published in the GitHub Security Advisory GHSA-6jcc-xgcr-q3h4 and committed in commit 14a2f8c. The patch reorders the inbox handler so that doesActorOwnKey validates signing key ownership before any call to routeActivity.

Workarounds

No upstream workaround is documented. Upgrading to a fixed version is the only supported remediation.
If an immediate upgrade is not possible, restrict inbox access at the reverse proxy to known federation peers as a temporary risk reduction measure.

bash

# Update Fedify to a fixed release using npm
npm install @fedify/fedify@^1.8.5

# Or for the 1.3.x maintenance branch
npm install @fedify/fedify@1.3.20