CVE-2026-46349: Mastodon Auth Bypass Vulnerability

CVE-2026-46349 Overview

CVE-2026-46349 affects Mastodon, an open-source federated social network server based on ActivityPub. The vulnerability resides in how Mastodon normalizes incoming activities signed with Linked-Data Signatures (LD-Signatures). Insufficient protection during normalization allows attackers to re-arrange a valid signed JSON-LD activity from a third-party actor so the server processes it differently than intended. This signature verification weakness maps to [CWE-347] Improper Verification of Cryptographic Signature. Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23 are affected.

Critical Impact
Attackers can spoof signed federated activities, causing Mastodon instances to process activities in a manner different from what the original signer authorized.

Affected Products

Mastodon versions prior to 4.3.23
Mastodon versions prior to 4.4.17
Mastodon versions prior to 4.5.10

Discovery Timeline

2026-06-24 - CVE-2026-46349 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-46349

Vulnerability Analysis

Mastodon federates with other ActivityPub servers by exchanging JSON-LD activities. To prove authenticity, these activities can carry Linked-Data Signatures (LD-Signatures), which sign the canonicalized form of the JSON-LD document. Mastodon normalizes incoming activities before processing them. The normalization step does not sufficiently protect against a class of structural manipulation that preserves signature validity while altering processing semantics. An attacker who possesses a legitimately signed activity from a third-party actor can re-arrange its content. The resulting activity still verifies against the original signer's key but is interpreted differently by the receiving instance. The vulnerability does not require authentication or user interaction and is exploitable over the network.

Root Cause

The root cause is incomplete coupling between the signed canonical form of a JSON-LD activity and the data structure Mastodon ultimately acts upon. When normalization discards or re-interprets elements that the verifier already accepted as signed, two semantically different activities can share a single valid signature. This is a known failure mode in JSON-LD signature schemes when normalization rules differ between signer and verifier.

Attack Vector

An attacker first obtains any signed activity emitted by a legitimate third-party actor on the fediverse. The attacker then re-arranges the JSON-LD payload, preserving the elements covered by the signature while changing how the receiving Mastodon instance interprets the activity. The attacker delivers the modified activity to a target Mastodon server over standard ActivityPub inbox endpoints. The server validates the signature, accepts the activity as authentic, and processes the manipulated semantics. Technical details are available in the Mastodon GitHub Security Advisory GHSA-chgx-jx3p-rf73.

Detection Methods for CVE-2026-46349

Indicators of Compromise

Inbound ActivityPub POST requests to /inbox or /users/*/inbox endpoints containing JSON-LD activities with unusual key ordering, duplicate keys, or unexpected @context arrangements.
Federated activities whose signer actor domain differs from the apparent originating server or whose semantics conflict with prior activities from the same actor.
Sidekiq job logs showing processed activities that do not match the canonical form retrievable from the originating server.

Detection Strategies

Compare the canonicalized hash of received JSON-LD activities against an independently re-fetched copy of the same activity from the originating server.
Alert on signed activities where the LD-Signature creator URL belongs to a different host than the delivering server.
Log and review activities that trigger state changes (deletes, blocks, follows) without matching prior client-visible actions from the actor.

Monitoring Recommendations

Enable verbose logging for ActivityPub inbox processing and retain logs for forensic correlation.
Monitor Mastodon application logs and Sidekiq queues for unexpected activity types from federated actors.
Track version drift across Mastodon instances and alert when servers run releases older than 4.3.23, 4.4.17, or 4.5.10.

How to Mitigate CVE-2026-46349

Immediate Actions Required

Upgrade Mastodon to version 4.5.10, 4.4.17, or 4.3.23 depending on the active release branch.
Restart all Mastodon web, streaming, and Sidekiq processes after the upgrade to ensure the patched code paths are loaded.
Audit recent federated activities for anomalies that may indicate exploitation prior to patching.

Patch Information

The vulnerability is fixed in Mastodon 4.5.10, 4.4.17, and 4.3.23. Operators should apply the upgrade through their standard deployment process. Refer to the Mastodon GitHub Security Advisory GHSA-chgx-jx3p-rf73 for release-specific upgrade notes.

Workarounds

No official workaround is published; upgrading to a fixed release is the supported remediation.
Temporarily restrict federation with untrusted instances using LIMITED_FEDERATION_MODE or domain allow-lists while patching is in progress.
Increase scrutiny of inbound activities by enabling additional logging and manual review of high-impact activity types until the upgrade is complete.

bash

# Configuration example - upgrade Mastodon via standard release process
cd /home/mastodon/live
git fetch --tags
git checkout v4.5.10
bundle install
yarn install --frozen-lockfile
RAILS_ENV=production bundle exec rails db:migrate
RAILS_ENV=production bundle exec rails assets:precompile
sudo systemctl restart mastodon-web mastodon-streaming mastodon-sidekiq