What’s Vulnerable › Vulnerabilities

CVE-2023-49095: nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-30 · updated 2026-06-17
• Weakness: CWE-20

Description

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.

Affected products

• nexryai nexkey: before 12.122.2 — fixed in 12.122.2

How to fix

Upgrade to a fixed version: nexryai nexkey 12.122.2. Check the vendor advisory for mitigations.

References

• https://github.com/nexryai/nexkey/commit/b96da0eac5a1e75abba94cf926f1251842829bab
• https://github.com/nexryai/nexkey/security/advisories/GHSA-fpxw-rw9v-2gmx
• https://github.com/nexryai/nexkey/commit/b96da0eac5a1e75abba94cf926f1251842829bab
• https://github.com/nexryai/nexkey/security/advisories/GHSA-fpxw-rw9v-2gmx

Get alerted when CVE-2023-49095 or the next vulnerability affects your stack