CVE-2025-54888 in fedify
Summary
by MITRE • 08/09/2025
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2025
The CVE-2025-54888 vulnerability represents a critical authentication bypass flaw in the Fedify TypeScript library that powers federated server applications using ActivityPub protocols. This vulnerability affects multiple version ranges spanning from 1.3.20 through 1.8.4, creating a widespread impact across federated social networks and applications that rely on ActivityPub for distributed communication. The flaw stems from improper validation of digital signatures during activity processing, allowing attackers to exploit the trust model inherent in federated systems.
The technical implementation of this vulnerability occurs at the core processing layer where Fedify validates ActivityPub activities before confirming that the signing key legitimately belongs to the claimed actor. This sequence error creates a window where forged activities can be accepted and processed without proper authentication verification. The vulnerability specifically targets the signature verification mechanism that should occur after activity parsing but before any actor impersonation logic is executed. Attackers can craft malicious activities signed with their own keys while claiming to represent other actors, effectively bypassing the entire authentication framework.
From an operational perspective, this vulnerability enables complete actor impersonation across all affected Fedify instances, allowing attackers to post content, send messages, and perform actions as any legitimate ActivityPub actor within the federated network. The impact extends beyond individual accounts to potentially compromise entire federated ecosystems, as the vulnerability affects the fundamental trust model that ActivityPub relies upon for secure distributed communication. This creates a cascading effect where compromised actors can influence other servers in the federation, potentially leading to widespread misinformation or malicious activity propagation.
The vulnerability maps directly to CWE-287 which addresses authentication bypass flaws, and aligns with ATT&CK technique T1566 related to phishing and credential harvesting. The exploitation pattern follows the typical attack vector of signature forgery combined with trust abuse in distributed systems. Organizations using Fedify versions within the affected ranges face significant risk of unauthorized access and data manipulation, particularly in environments where federated communication is critical for user interaction and content distribution.
Mitigation strategies require immediate deployment of patched versions including 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, and 1.8.5 across all affected systems. Security teams should conduct comprehensive audits of their federated applications to identify any potential exploitation that may have occurred during the vulnerability window. Additional defensive measures include implementing enhanced monitoring for suspicious activity patterns and establishing more rigorous signature validation protocols. The patch addresses the fundamental ordering issue in the activity processing pipeline by ensuring signature verification occurs before any actor impersonation logic is executed, thereby restoring proper authentication controls.