Improper Authentication in Mastodon - #VU159851
Published: November 6, 2026
Vulnerability identifier: #VU159851
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to impersonate other remote actors in Mastodon.
The vulnerability exists due to insufficient authentication of ActivityPub identifiers when Mastodon processes incoming posts and quote or collection approval stamps. An unauthenticated remote attacker can craft these posts and approval stamps so they appear to originate from another remote actor rather than the actual sender.
Affected software
Mastodon
Remediation
Install security update from vendor's website.
Mastodon - addressed in versions 4.4.27, 4.5.20, 4.6.10, 4.7.4