What’s Vulnerable › Vulnerabilities

CVE-2026-50128: Mastodon: Spoofing of attribution domains

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-24 · updated 2026-06-25
• Weakness: CWE-354

Description

Mastodon is a free, open-source social network server based on ActivityPub. From 4.3.0 until 4.5.11 and 4.4.18, Mastodon has a feature to let websites credit authors of their articles. To prevent false attribution claims, Mastodon uses the attributionDomains JSON-LD term, however, an error in how it is defined makes Linked Data Signatures on the toot:attributionDomains property ineffective. An attacker can arbitrarily modify the attributionDomains value of a legitimately signed Update activity and bypass Mastodon’s signature verification. This vulnerability is fixed in 4.5.11 and 4.4.18.

Affected products

• mastodon: from 4.5.0-beta.1, < 4.5.11; from 4.3.0, < 4.4.18

References

• https://github.com/mastodon/mastodon/security/advisories/GHSA-rwcw-vq68-g34p
• https://github.com/gogs/gogs/security/advisories/GHSA-pwx3-qcgw-vh7h

Get alerted when CVE-2026-50128 or the next vulnerability affects your stack