Executive brief
Fedify is a library used to build federated social media servers that communicate using the ActivityPub protocol. A security flaw allows attackers to manipulate the structure of signed messages (like posts or profile updates) without breaking their digital signatures. This could allow an attacker to impersonate users or alter the content of messages, potentially leading to the spread of misinformation or unauthorized account actions across the federated network.
Technical details
A signature bypass vulnerability exists in Fedify due to improper handling of JSON-LD features such as @graph, @included, and @reverse. Because signatures are verified against the canonical RDF graph representation, an attacker can restructure the JSON-LD document to change how the library interprets the root activity while the underlying graph (and thus the signature) remains valid. For example, an attacker could move a nested object to the top level or use @included to hide properties from the implementation. Additionally, the library failed to compact documents against a local context after verification, allowing attackers to use aliases to replace arbitrary portions of a signed document. The issue is resolved by rejecting problematic JSON-LD keywords and ensuring proper compaction.
Affected products
- fedify-dev fedify < 1.9.11, < 1.10.10, < 2.0.18, < 2.1.14, < 2.2.3
Timeline
- 2026-05-20: patched: Version 2.2.3 released
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE-2026-42462 published to NVD