CVE-2026-50128: Mastodon: Spoofing of attribution domains
Mastodon is a free, open-source social network server based on ActivityPub. From 4.3.0 until 4.5.11 and 4.4.18, Mastodon has a feature to let websites credit authors of their articles. To prevent false attribution claims, Mastodon uses the attributionDomains JSON-LD term, however, an error in how it is defined makes Linked Data Signatures on the toot:attributionDomains property ineffective. An attacker can arbitrarily modify the attributionDomains value of a legitimately signed Update activity and bypass Mastodon’s signature verification. This vulnerability is fixed in 4.5.11 and 4.4.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mastodonto a version that resolves this vulnerability.Fixed in 4.5.11 - Upgrade
Upgrade
Mastodonto a version that resolves this vulnerability.Fixed in 4.4.18
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50128?
CVE-2026-50128 has a medium severity rating of 5.3.
How does CVE-2026-50128 affect Mastodon?
CVE-2026-50128 allows for spoofing of attribution domains, potentially leading to false attribution claims.
What versions of Mastodon are affected by CVE-2026-50128?
CVE-2026-50128 affects Mastodon versions from 4.3.0 to 4.5.11 and version 4.4.18.
How do I fix CVE-2026-50128?
To fix CVE-2026-50128, upgrade to a patched version of Mastodon that addresses this vulnerability.
What type of attack does CVE-2026-50128 enable?
CVE-2026-50128 enables the attack of spoofing attribution domains in Mastodon.