Authentication Bypass in Fedify TypeScript Library Affects Multiple Versions
CVE-2025-54888

8.7HIGH

Key Information:

Vendor

Fedify-dev

Status
Fedify
Vendor
CVE Published:
9 August 2025

What is CVE-2025-54888?

The Fedify TypeScript library, used for building federated server applications, is vulnerable to an authentication bypass that permits unauthenticated attackers to impersonate any ActivityPub actor. This issue arises in various versions where activities are processed without verifying if the signing key belongs to the claimed actor. The flaw allows any attacker to send forged activities signed with their own keys, leading to complete actor impersonation across all instances of Fedify. This vulnerability has been addressed in subsequent releases where affected versions have been fixed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

fedify < 1.3.20 < 1.3.20

fedify >= 1.4.0-dev.585, < 1.4.13 < 1.4.0-dev.585, 1.4.13

fedify >= 1.5.0-dev.636, < 1.5.5 < 1.5.0-dev.636, 1.5.5

References

https://github.com/fedify-dev/fedify/security/advisories/...
x_refsource_CONFIRM
https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3c...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

JSON
.