Executive brief
Mastodon is an open-source social networking platform. A security flaw in how the software processes incoming messages allows attackers to selectively remove or hide parts of a post while keeping the digital signature valid. This could be used to spoof or manipulate the content of messages received from other users, potentially leading to misinformation or the unauthorized modification of shared data.
Technical details
A vulnerability exists in Mastodon's normalization process for incoming activities signed with Linked-Data Signatures (LDS). Due to improper validation of the integrity check value (CWE-354), an attacker who obtains a valid signed activity—for example, via ActivityPub inbox forwarding or a shared relay—can selectively remove JSON entries from the object. The Mastodon server will then recognize the modified object as a complete and validly signed activity. This allows for a specific class of spoofing where the integrity of the message is compromised without invalidating the cryptographic signature. The issue is resolved in versions 4.5.10, 4.4.17, and 4.3.23.
Affected products
- Mastodon Mastodon < 4.3.23, >= 4.4.0-beta.1 < 4.4.17, >= 4.5.0-beta.1 < 4.5.10
Timeline
- 2026-05-20: advisory: GitHub advisory published by Mastodon maintainers
- 2026-06-24: disclosed: CVE published to NVD