Executive brief
Mastodon is an open-source social networking platform. A security flaw in how the software verifies digital signatures allows attackers to manipulate and re-send certain types of social media activities, such as 'boosts' (re-shares), without the original user's permission. While this does not expose private data, it allows for the spoofing of user interactions and could be used to spread misinformation or bypass previous content retractions.
Technical details
A signature verification bypass exists in Mastodon's handling of JSON-LD activities signed with Linked-Data Signatures (CWE-347). The root cause is insufficient protection during the normalization process, which allows an attacker to restructure a validly signed activity from a third party. By re-arranging the named-graph structure of the JSON-LD data, an attacker can force the server to process the activity differently than intended, such as re-issuing retracted 'Announce' (boost) activities. This is a network-reachable vulnerability requiring no authentication or user interaction. Patches are available in versions 4.5.10, 4.4.17, and 4.3.23.
Affected products
- Mastodon Mastodon < 4.5.10, < 4.4.17, < 4.3.23
Timeline
- 2026-05-20: advisory: Initial GitHub advisory published
- 2026-06-24: disclosed: CVE published to NVD