@fedify/fedify has Improper Authentication and Incorrect Authorization
Date: 2025-08
Affected: npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-54888
CWE: CWE-287
CWE-863

### Summary An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances ### Details The vulnerability exists in handleInboxInternal function in fedify/federation/handler.ts. The critical flaw is in the order of operations: 1. Line 1712: routeActivity() is called first, which processes the activity (either immediately or by adding to queue) 2. Line 1730: Authentication check (doesActorOwnKey) happens AFTER processing ```ts // fedify/federation/handler.ts:1712-1750 const routeResult = await routeActivity({ // ← Activity processed here context: ctx, json, activity, recipient, inboxListeners, inboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, }); if ( httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx) // ← Auth check too late ) { // Returns 401, but activity already processed return new Response("The signer and the actor do not match.", { status: 401, headers: { "Content-Type": "text/plain; charset=utf-8" }, }); } ``` By the time the 401 response is returned, the malicious activity has already been processed or queued. ### PoC 1. Create an activity claiming to be fr


Mitigations:

Architectural layers (MAESTRO):