8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54888

CVE-2025-54888: @fedify/fedify: Improper Authentication and Incorrect Authorization

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54888

CVE-2025-54888:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@fedify/fedify	npm	< 1.3.20	1.3.20
@fedify/fedify	npm	>= 1.4.0-dev.585, < 1.4.13	1.4.13
@fedify/fedify	npm	>= 1.5.0-dev.636, < 1.5.5	1.5.5
@fedify/fedify	npm	>= 1.6.0-dev.754, < 1.6.8	1.6.8
@fedify/fedify	npm	>= 1.7.0-pr.251.885, < 1.7.9	1.7.9
@fedify/fedify	npm	>= 1.8.0-dev.909, < 1.8.5	1.8.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic authentication bypass caused by an incorrect order of operations in the @fedify/fedify package. The core of the issue is in the handleInboxInternal function located in src/federation/handler.ts.

The analysis of the patch commit 226d9b84dbec52172a70138bba8861454afde42b clearly shows the remediation. Originally, the code first processed the incoming ActivityPub activity by calling routeActivity and only afterward attempted to verify the signature's ownership with doesActorOwnKey. This meant that even if the signature verification failed and a 401 Unauthorized response was sent, the malicious activity had already been processed and accepted by the system.

The fix was to simply reorder these operations: first, perform the doesActorOwnKey check, and only if it passes, proceed to call routeActivity.

Therefore, the primary vulnerable function is handleInboxInternal, as it contains the flawed logic. The handleInbox function is its public wrapper and the entry point for the vulnerable code path. The routeActivity function is also a key runtime indicator, as it's the component that executes the malicious action (e.g., creating a post as the impersonated user). All three functions would likely appear in a runtime profile or stack trace during the exploitation of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.