TI-2023-26760 Aliases CVE-2023-49095

nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

MEDIUM 44CWE-20Published 2023-11-30 · Updated 2024-11-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00565 47th percentileScored 2026-11-07

Fix Fixed nexkey (nexryai): 12.122.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nexryai	nexkey	before 12.122.2	12.122.2	Patch available	CNA

nexkey Vendornexryai Affected before 12.122.2 Fixed in 12.122.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nexryai:nexkey::::::node.js::*	before 12.122.2	Vulnerable	nexryai

cpe:2.3:a:nexryai:nexkey:*:*:*:*:*:node.js:*:* Versions before 12.122.2 Vulnerable ·nexryai

Remediation

Fix · CNA nexkey (nexryai) Fixed in 12.122.2

Timeline

2026-10-02 Threatist record created from CVE-2023-49095

References

Patch 2

TI-2023-28521 External apps using tokens issued by administrators and moderators can call admin APIs CVSS 3.1CRITICAL 9.8
TI-2023-23496 Nexkey allows users to bypass authentication of Bull dashboard CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences