CVE-2025-54888: @fedify/fedify Authentication Bypass and Actor Impersonation Vulnerability
Summary
CVE-2025-54888: @fedify/fedify has Improper Authentication and Incorrect Authorization. Affects @fedify/fedify across 6 version ranges.
< 1.3.20
>= 1.4.0-dev.585, < 1.4.13
>= 1.5.0-dev.636, < 1.5.5
>= 1.6.0-dev.754, < 1.6.8
>= 1.7.0-pr.251.885, < 1.7.9
>= 1.8.0-dev.909, < 1.8.5
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @fedify/fedify package is a tool designed for implementing ActivityPub protocols, enabling decentralized social networking functionalities. It allows users to interact across different platforms while maintaining their identities. However, a critical vulnerability has been identified that allows unauthenticated attackers to impersonate any ActivityPub actor, undermining the security and trust model of the federation.
Vulnerability Detail
The vulnerability arises from an authentication bypass in the handleInboxInternal function within fedify/federation/handler.ts. The flaw is due to the order of operations where the activity is processed before verifying the signing key belongs to the claimed actor. This allows an attacker to send forged activities signed with their own keys, leading to complete actor impersonation across all Fedify instances. The consequences include sending fake posts, creating/removing follows, and compromising the federation trust model.
How To Fix
Latest published version: 2.4.4 as of 23 Oct 2026
npm install @fedify/fedify@2.4.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.3.201.3.20npm install @fedify/fedify@1.3.20 -
>= 1.4.0-dev.585, < 1.4.131.4.13npm install @fedify/fedify@1.4.13 -
>= 1.5.0-dev.636, < 1.5.51.5.5npm install @fedify/fedify@1.5.5 -
>= 1.6.0-dev.754, < 1.6.81.6.8npm install @fedify/fedify@1.6.8 -
>= 1.7.0-pr.251.885, < 1.7.91.7.9npm install @fedify/fedify@1.7.9 -
>= 1.8.0-dev.909, < 1.8.51.8.5npm install @fedify/fedify@1.8.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that all incoming activities are manually verified before processing them. This can be done by implementing additional checks in the application logic to validate the authenticity of the actor's signing key before any activity is processed.
Conclusion
The CVE-2025-54888 vulnerability in the @fedify/fedify package poses a significant risk to users by allowing actor impersonation through an authentication bypass. It is crucial to update to version 1.8.5 or later to mitigate this risk and ensure the integrity of the federation.
See every vulnerability recorded for @fedify/fedify →
FAQ
CVE-2025-54888 is a vulnerability in the @fedify/fedify package that allows unauthenticated attackers to impersonate any ActivityPub actor.
Users of Fedify instances are at risk of having their identities impersonated, which can lead to unauthorized actions such as sending fake messages or altering follow relationships.
All versions prior to 1.8.5 are affected by this vulnerability, including versions 0.0.0 to 1.8.0-dev.909.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If immediate updates are not possible, implement manual verification of incoming activities to ensure they are from legitimate actors before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for @fedify/fedify.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
