What is the CVSS score of CVE-2026-50128?

CVE-2026-50128 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-50128?

Yes, a patch is available for CVE-2026-50128. Update the affected software to the latest version immediately.

Mastodon CVE-2026-50128

EUVD-2026-39059 MEDIUM

Improper Validation of Integrity Check Value (CWE-354)

2026-06-24 GitHub_M

Authentication Bypass Mastodon

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible federated protocol, no auth on victim instance, integrity-only impact limited to attribution metadata, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Analysis Generated

Jun 24, 2026 - 20:52 vuln.today

DescriptionCVE.org

Mastodon is a free, open-source social network server based on ActivityPub. From 4.3.0 until 4.5.11 and 4.4.18, Mastodon has a feature to let websites credit authors of their articles. To prevent false attribution claims, Mastodon uses the attributionDomains JSON-LD term, however, an error in how it is defined makes Linked Data Signatures on the toot:attributionDomains property ineffective. An attacker can arbitrarily modify the attributionDomains value of a legitimately signed Update activity and bypass Mastodon’s signature verification. This vulnerability is fixed in 4.5.11 and 4.4.18.

AnalysisAI

Signature bypass in Mastodon's ActivityPub federation layer allows remote unauthenticated attackers to falsely attribute article authorship by manipulating the toot:attributionDomains property of signed Update activities. Affected are all Mastodon instances running versions 4.3.0 through 4.5.10 or 4.4.x through 4.4.17, where a JSON-LD definition error renders Linked Data Signatures on this specific property non-binding. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity (CVSS AV:N/AC:L/PR:N) and the federated, internet-exposed nature of the protocol make exploitation straightforward for any actor able to send ActivityPub messages.

Technical ContextAI

Mastodon implements the W3C ActivityPub protocol for federated social networking, using JSON-LD for semantic data representation and Linked Data Signatures (LDS) for verifying the integrity and origin of federated activities. The toot:attributionDomains term was introduced to allow websites to credit article authors while preventing impersonation - a Mastodon instance accepts an author credit only if the domain hosting the article matches an attributionDomains value in a signed Update activity. The root cause (CWE-354: Improper Validation of Integrity Check Value) is a definitional error in how toot:attributionDomains is declared in the JSON-LD context: the term is not correctly scoped or canonicalized, so LDS processing excludes or does not bind this property during signature computation. Consequently, an attacker can alter the attributionDomains array in a legitimately signed Update activity in transit or at the relay stage without invalidating the envelope signature. The affected CPE is cpe:2.3:a:mastodon:mastodon:*:*:*:*:*:*:*:* for versions 4.3.0 through those preceding the fixes.

RemediationAI

Upgrade to Mastodon 4.5.11 (for the 4.5.x branch) or 4.4.18 (for the 4.4.x branch) - these are the vendor-confirmed fixed releases per the GitHub advisory GHSA-rwcw-vq68-g34p at https://github.com/mastodon/mastodon/security/advisories/GHSA-rwcw-vq68-g34p. If an immediate upgrade is not possible, the only targeted compensating control is to disable or not rely on the author-crediting (fediverse attribution) feature, since the flaw is specific to the attributionDomains processing path. General federation cannot be disabled as a practical workaround without breaking core Mastodon functionality. There are no known side effects to patching beyond the standard upgrade process.