# CVE-2025-54888: Fedify authentication bypass in ActivityPub inbox handler

Source: https://junglewise.ai/threats/cve-2025-54888-fedify-authentication-bypass-in-activitypub-inbox-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-54888 · Severity: medium · CVSS 4 · Published 2025-08-08

Fedify is a library for building federated social networks using the ActivityPub protocol. An authentication bypass vulnerability allows attackers to impersonate any user by sending forged messages to a Fedify-based social network instance. Attackers can create fake posts, follow/unfollow accounts, and boost content as any legitimate user, completely undermining trust in the federated network.

Technologies: [Fedify](https://junglewise.ai/threats/technologies/fedify). Vendors: [Fedify](https://junglewise.ai/threats/vendors/fedify).

## Quick answers

**Is CVE-2025-54888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54888 being exploited in the wild.

**How severe is CVE-2025-54888?** Medium severity, with a CVSS score of 4, published 8 August 2025.

**Which products and versions are affected?** Fedify all versions prior to 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, 1.8.5.

**Is there a fix for CVE-2025-54888?** A patch was published on 2025-08-08: Fixed versions released across multiple branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-54888 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-54888?** Check whether you run Fedify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authentication flaw (CWE-287, CWE-863) in the handleInboxInternal function of fedify/federation/handler.ts. The root cause is incorrect order of operations: activities are routed and processed (line 1712) before HTTP signature authentication is validated (line 1730). An attacker can craft an ActivityPub activity claiming to be from any victim actor, sign the HTTP request with their own key, and send it to a Fedify inbox. The activity is processed and queued immediately; the authentication check occurs only after processing, returning a 401 response when it fails—but the damage is already done. No authentication or special privileges are required to exploit this; it affects all Fedify instances up to version 1.8.4. Patches are available: 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, and 1.8.5.

## Affected products

- Fedify fedify all versions prior to 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9, 1.8.5

## Identifiers

- CVE-2025-54888
- GHSA-6jcc-xgcr-q3h4

## Timeline

- 2025-08-08: disclosed: Vulnerability published
- 2025-08-09: advisory: NVD published CVE-2025-54888
- 2025-08-08: patched: Fixed versions released across multiple branches

## References

- [https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4](https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4)

## Related threats

- [Fedify getNodeInfo() server-side request forgery](https://junglewise.ai/threats/cve-2026-62857-fedify-getnodeinfo-server-side-request-forgery)
- [Fedify SSRF via incomplete IPv4 validation in validatePublicUrl](https://junglewise.ai/threats/cve-2026-50131-fedify-ssrf-via-incomplete-ipv4-validation-in-validatepublicurl)
- [Fedify Linked Data Signature bypass via JSON-LD restructuring](https://junglewise.ai/threats/cve-2026-42462-fedify-linked-data-signature-bypass-via-json-ld-restructuring)
- [Fedify unbounded redirect following resource exhaustion in document loader](https://junglewise.ai/threats/cve-2026-34148-fedify-unbounded-redirect-following-resource-exhaustion-in)
- [Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.](https://junglewise.ai/threats/cve-2025-68475-fedify-redos-vulnerability-in-html-parsing-regex)