CVE-2025-54888 @fedify/fedify: Improper Authentication and Incorrect Authorization
Unauthenticated attackers can impersonate any ActivityPub actor by sending forged activities, leading to account takeover and data modification in Fedify-based applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54888?
CVE-2025-54888 is a high-severity authentication bypass vulnerability in fedify-dev fedify, published on 9 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.
Which versions are affected by CVE-2025-54888?
12 open source packages ship an affected version, including @fedify/fedify.
| Package | Affected | Fixed in |
|---|---|---|
@fedify/fedify npm | All versions | 1.3.20 |
@fedify/fedify npm | All versions | 1.3.20 |
@fedify/fedify npm | From 1.4.0-dev.585 | 1.4.13 |
@fedify/fedify npm | From 1.4.0-dev.585 | 1.4.13 |
@fedify/fedify npm | From 1.5.0-dev.636 | 1.5.5 |
@fedify/fedify npm | From 1.5.0-dev.636 | 1.5.5 |
6 more packages
@fedify/fedify npm | From 1.6.0-dev.754 | 1.6.8 |
@fedify/fedify npm | From 1.6.0-dev.754 | 1.6.8 |
@fedify/fedify npm | From 1.7.0-pr.251.885 | 1.7.9 |
@fedify/fedify npm | From 1.7.0-pr.251.885 | 1.7.9 |
@fedify/fedify npm | From 1.8.0-dev.909 | 1.8.5 |
@fedify/fedify npm | From 1.8.0-dev.909 | 1.8.5 |
How do I fix CVE-2025-54888?
Upgrade @fedify/fedify to a fixed version for your release line: 1.3.20, 1.4.13, 1.5.5 or 1.6.8.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-54888 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54888 exists.
Sources
Also known as GHSA-6jcc-xgcr-q3h4.