Mastodon CVE-2026-50128

The attacker must be able to relay or inject ActivityPub Update activities to a target Mastodon instance, which is possible for any operator of a federated ActivityPub-compatible server or for a network-adjacent actor with the ability to intercept inter-server federation traffic. No authentication on the victim instance is required (confirmed by CVSS PR:N). The vulnerability is limited to Update activities that carry the toot:attributionDomains property - instances that have never configured or received author-crediting activities are not exposed to the specific impact, though the code path is present by default in all affected versions. Exploitation is limited by the narrow impact: only author attribution metadata can be falsified; no account takeover, credential theft, or remote code execution is possible through this path.

The NVD CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately characterizes the attack surface: fully remote, no authentication, low complexity, but limited to a low-integrity impact confined to author attribution data. There is no confidentiality or availability impact. EPSS data is not provided in the input, and the vulnerability is not listed in the CISA KEV catalog, so exploitation probability cannot be quantified numerically. No public POC is identified. The practical threat is misinformation and reputational harm - an attacker can falsely claim that a domain endorsed or authored content it did not, undermining trust in Mastodon's author-crediting feature. This is not a code execution or credential-theft vulnerability. SSVC signals: exploitation status is none/unreported; the attack is automatable given PR:N and low complexity; technical impact is partial (integrity only). Despite the open network vector and lack of authentication requirement, the narrow impact domain (attribution metadata only) means this is a real but low-urgency patch priority for most operators.

An attacker operating a malicious or compromised federated server intercepts a legitimately signed Update activity from a trusted Mastodon instance that includes a valid attributionDomains value crediting a reputable news domain. The attacker replaces the domain value with an arbitrary target domain and forwards the modified activity to victim Mastodon instances; because the JSON-LD definition error excludes this property from LDS computation, the signature validates successfully and the false attribution is accepted. No public POC exists at time of analysis, but the attack requires only the ability to relay ActivityPub messages - a capability inherent to any federated server operator.