Is CVE-2026-90679 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90679 being exploited in the wild.

How severe is CVE-2026-90679?

Medium severity, with a CVSS score of 4.3, published 13 September 2026.

Is there a fix for CVE-2026-90679?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90679 attacked?

It is attacked over the network.

Am I affected by CVE-2026-90679?

Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90679: Forgejo ActivityPub identity spoofing via unbound HTTP signature

CVE-2026-90679 · Severity: medium · CVSS 4.3 · Published 2026-09-13

Forgejo is a self-hosted Git service that supports federated communication with other platforms through ActivityPub. When federation is enabled, attackers can forge activities (such as follows, unfollows, or repository stars) attributed to any identity by hosting a single valid keypair and signing requests with their own key while claiming a different sender in the activity body. This undermines trust in user identities and social relationships but does not enable account takeover or content modification.

Technologies: Forgejo. Vendors: Forgejo.

Quick answers

Is CVE-2026-90679 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90679 being exploited in the wild.
How severe is CVE-2026-90679?: Medium severity, with a CVSS score of 4.3, published 13 September 2026.
Which products and versions are affected?: Forgejo 13.0.0 through 16.0.4.
Is there a fix for CVE-2026-90679?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90679 attacked?: It is attacked over the network.
Am I affected by CVE-2026-90679?: Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an HTTP Signature verification bypass in the ActivityPub inbox handlers (routers/api/v1/activitypub/reqsignature.go). The code validates that an incoming request carries a valid HTTP Signature, but then reads the acting identity directly from the attacker-controlled JSON activity body without binding it to the verified signing key. Additionally, the signed Digest header is never recomputed against the received request body, allowing digest tampering. An attacker with one valid actor keypair can submit activities attributed to any identity, including shadowing local users, creating fake identities, forging follow/unfollow relationships, and starring repositories. The fix requires binding the keyId owner to the activity's actor field and recomputing the Digest header. Federation must be explicitly enabled in configuration; it is disabled by default.

Affected products

Forgejo Forgejo 13.0.0 through 16.0.4

Timeline

2026-09-07: disclosed: Security issue reported to Forgejo project
2026-09-13: advisory: CVE-2026-90679 published

References

https://codeberg.org/forgejo/forgejo/issues/14271

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.