CVE-2026-50128: Mastodon AttributionDomains Signature Bypass Vulnerability

Technical summary

The vulnerability stems from improper definition of the attributionDomains JSON-LD term in Mastodon's implementation of Linked Data Signatures. When an ActivityPub Update activity contains attribution information, Mastodon intends to cryptographically sign the data to ensure authenticity. However, due to the configuration error, the toot:attributionDomains property is not properly included in the signature verification scope. This allows an attacker to intercept or modify a legitimately signed Update activity, change the attributionDomains value to claim false authorship or credit, and have Mastodon accept the modification as valid. The underlying issue is categorized as an improper verification of a cryptographic signature (CWE-354).

Business impact

For Mastodon instances and their users, this vulnerability undermines content provenance and journalistic integrity. Users relying on attribution metadata to identify the original source of shared articles cannot trust that information. News organizations, publishers, and content creators using Mastodon for distribution face reputational risk if their work is falsely attributed or if attribution is stripped. Instance administrators may face user complaints and loss of confidence in the platform's integrity guarantees. The impact is primarily reputational and trust-based rather than causing data loss or service disruption.

Affected systems

Mastodon versions 4.3.0 through 4.5.10 (inclusive) and 4.4.0 through 4.4.17 (inclusive) are affected. Mastodon 4.5.11 and 4.4.18 contain the fix. Self-hosted Mastodon instances running unpatched versions are at risk. Managed Mastodon hosting providers and federated instances using vulnerable versions can be exploited by remote attackers to inject false attribution metadata.

Exploitability

This vulnerability requires no special privileges, authentication, or user interaction to exploit. An attacker with network access can craft malicious ActivityPub Update activities and send them to vulnerable Mastodon instances. The attack is straightforward: modify the attributionDomains property of a legitimately signed activity and submit it. Because signature verification does not cover this property, the instance will accept the forged attribution. The CVSS score of 5.3 (MEDIUM) reflects the low attack complexity and network-accessible nature, though impact is limited to integrity of metadata rather than confidentiality or availability.

Remediation

Upgrade Mastodon to version 4.5.11 (for the 4.5.x line) or 4.4.18 (for the 4.4.x line) or later. These releases include the corrected JSON-LD definition that properly encompasses attributionDomains in the signature verification scope. Instance administrators should prioritize patching given the simplicity of exploitation, even though severity is rated MEDIUM. No workarounds are available; patching is the only mitigation.

Patch guidance

Administrators of self-hosted Mastodon instances should consult the official Mastodon repository and release notes for upgrade instructions specific to their deployment (Docker, source installation, etc.). Review the migration guide if jumping multiple minor versions. Test the upgrade in a staging environment first. For managed Mastodon hosting, contact your provider to confirm patch deployment timeline. Verify the fix by checking the instance version and confirming the JSON-LD signature definition change in the patched code, if possible. After upgrade, monitor federation logs for any anomalies during the transition period.

Detection guidance

Monitor for ActivityPub Update activities where the attributionDomains property differs from what your records show for a given content creator or article source. Implement logging of all incoming Update activities and periodically audit high-value content for attribution drift. Check your Mastodon instance logs for signature verification events or warnings (if verbose logging is enabled). On a preventive basis, ensure your instance is running the patched version by checking the /api/v1/instance endpoint for the version field. For federated instances, cross-reference published attribution claims against the originating server's claims to detect inconsistencies.

Why prioritize this

While the CVSS score is MEDIUM (5.3), the vulnerability is straightforward to exploit and directly undermines trust in content attribution—a core feature of a social network used by journalists and publishers. The attack requires no authentication and can be automated. The fix is available and non-disruptive, making patching a reasonable near-term priority. Organizations relying on Mastodon for content distribution or those operating public instances should patch promptly to avoid reputational damage and user complaints.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). The low integrity impact rating recognizes that only metadata is affected, not user data or service availability. However, in contexts where content attribution is critical (journalism, academic publishing), the business impact may justify treating this as higher priority than the base score alone suggests.

Frequently asked questions