CVE-2026-46349
Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to re-arrange a valid signed JSON-LD activity from a third-party actor to have it processed differently. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.
Summary dbcve.org
Mastodon's ActivityPub signature verification has a flaw in JSON-LD normalization. When processing incoming activities signed with Linked-Data Signatures, the normalization process does not produce a sufficiently canonical form, allowing attackers to rearrange JSON-LD structures within a valid signed activity. This changes how the activity is processed while the signature remains technically valid, enabling spoofing of legitimate signed federated content.
Mitigation
Upgrade Mastodon to version 4.5.10, 4.4.17, or 4.3.23 (or later) to obtain the patched normalization logic for Linked-Data Signature verification.