> CVE-2025-54888

« BACK_TO_HOME
PUBLISHED
2025-08-09 02:15
MODIFIED
2025-08-11 18:32
EPSS (Prob. Exploit)
0.61%
Top 51.3%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01

> DESCRIPTION

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-6jcc-xgcr-q3h4 HIGH

@fedify/fedify has Improper Authentication and Incorrect Authorization

AFFECTED PACKAGES:
NPM / @fedify/fedify
>= 1.8.0-dev.909, < 1.8.5
Fixed in: 1.8.5
NPM / @fedify/fedify
>= 1.7.0-pr.251.885, < 1.7.9
Fixed in: 1.7.9
NPM / @fedify/fedify
>= 1.6.0-dev.754, < 1.6.8
Fixed in: 1.6.8
NPM / @fedify/fedify
>= 1.5.0-dev.636, < 1.5.5
Fixed in: 1.5.5
NPM / @fedify/fedify
>= 1.4.0-dev.585, < 1.4.13
Fixed in: 1.4.13
NPM / @fedify/fedify
< 1.3.20
Fixed in: 1.3.20

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

@fedify/fedify: Improper Authentication and Incorrect Authorization

AFFECTED PACKAGES:
Unknown / Unknown
143 versions affected
ALIASES:
GHSA-6jcc-xgcr-q3h4

> HISTORIQUE DES MODIFICATIONS

Première apparition
09/08/2025 02:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:07
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME