Read the docs
TI-2025-34622 Aliases CVE-2025-54888GHSA-6jcc-xgcr-q3h4

@fedify/fedify: Improper Authentication and Incorrect Authorization

Priority HIGH 77CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00649 51st percentileScored 2026-11-07
Fix Fixed fedify (fedify-dev): 1.3.20, 1.4.13, 1.5.5 +3@fedify/fedify (npm): 1.3.20, 1.4.13, 1.5.5 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fedify-devfedifybefore 1.3.20; 1.4.0-dev.585 to before 1.4.13; 1.5.0-dev.636 to before 1.5.5; 1.6.0-dev.754 to before 1.6.8; 1.7.0-pr.251.885 to before 1.7.9; 1.8.0-dev.909 to before 1.8.51.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, 1.8.5Patch availableCNA
—@fedify/fedify (npm)before 1.3.201.3.20Patch availableGHSA-6jcc-xgcr-q3h4
—@fedify/fedify (npm)1.4.0-dev.585 to before 1.4.131.4.13Patch availableGHSA-6jcc-xgcr-q3h4
—@fedify/fedify (npm)1.5.0-dev.636 to before 1.5.51.5.5Patch availableGHSA-6jcc-xgcr-q3h4
—@fedify/fedify (npm)1.6.0-dev.754 to before 1.6.81.6.8Patch availableGHSA-6jcc-xgcr-q3h4
—@fedify/fedify (npm)1.7.0-pr.251.885 to before 1.7.91.7.9Patch availableGHSA-6jcc-xgcr-q3h4
—@fedify/fedify (npm)1.8.0-dev.909 to before 1.8.51.8.5Patch availableGHSA-6jcc-xgcr-q3h4
  • fedify Vendorfedify-dev Affected before 1.3.20; 1.4.0-dev.585 to before 1.4.13; 1.5.0-dev.636 to before 1.5.5; 1.6.0-dev.754 to before 1.6.8; 1.7.0-pr.251.885 to before 1.7.9; 1.8.0-dev.909 to before 1.8.5 Fixed in 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, 1.8.5 Patch available CNA
  • @fedify/fedify (npm) Vendor— Affected before 1.3.20 Fixed in 1.3.20 Patch available GHSA-6jcc-xgcr-q3h4
  • @fedify/fedify (npm) Vendor— Affected 1.4.0-dev.585 to before 1.4.13 Fixed in 1.4.13 Patch available GHSA-6jcc-xgcr-q3h4
  • @fedify/fedify (npm) Vendor— Affected 1.5.0-dev.636 to before 1.5.5 Fixed in 1.5.5 Patch available GHSA-6jcc-xgcr-q3h4
  • @fedify/fedify (npm) Vendor— Affected 1.6.0-dev.754 to before 1.6.8 Fixed in 1.6.8 Patch available GHSA-6jcc-xgcr-q3h4
  • @fedify/fedify (npm) Vendor— Affected 1.7.0-pr.251.885 to before 1.7.9 Fixed in 1.7.9 Patch available GHSA-6jcc-xgcr-q3h4
  • @fedify/fedify (npm) Vendor— Affected 1.8.0-dev.909 to before 1.8.5 Fixed in 1.8.5 Patch available GHSA-6jcc-xgcr-q3h4

Remediation

  • Fix · CNA fedify (fedify-dev) Fixed in 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, 1.8.5
  • Fix · GHSA-6jcc-xgcr-q3h4 @fedify/fedify (npm) Fixed in 1.3.20 Advisory →
  • Fix · GHSA-6jcc-xgcr-q3h4 @fedify/fedify (npm) Fixed in 1.4.13 Advisory →
  • Fix · GHSA-6jcc-xgcr-q3h4 @fedify/fedify (npm) Fixed in 1.5.5 Advisory →
  • Fix · GHSA-6jcc-xgcr-q3h4 @fedify/fedify (npm) Fixed in 1.6.8 Advisory →
  • Fix · GHSA-6jcc-xgcr-q3h4 @fedify/fedify (npm) Fixed in 1.7.9 Advisory →
  • Fix · GHSA-6jcc-xgcr-q3h4 @fedify/fedify (npm) Fixed in 1.8.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54888
  2. 2026-10-03 Alias added: GHSA-6jcc-xgcr-q3h4
  3. 2026-10-30 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 3

  • TI-2026-44926 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources CVSS 4.0HIGH 8.8
  • TI-2026-36902 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges CVSS 3.1HIGH 8.6
  • TI-2025-33806 Hollo renders posts received with form elements and allows submission CVSS 3.1MEDIUM 6.1
  • TI-2026-30750 Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring CVSS 3.1HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences