CVE-2026-50128

Mastodon is a free, open-source social network server based on ActivityPub. From 4.3.0 until 4.5.11 and 4.4.18, Mastodon has a feature to let websites credit authors of their articles. To prevent false attribution claims, Mastodon uses the attributionDomains JSON-LD term, however, an error in how it is defined makes Linked Data Signatures on the toot:attributionDomains property ineffective. An attacker can arbitrarily modify the attributionDomains value of a legitimately signed Update activity and bypass Mastodon’s signature verification. This vulnerability is fixed in 4.5.11 and 4.4.18.

• CWE-354

• https://github.com/mastodon/mastodon/security/advisories/GHSA-rwcw-vq68-g34p
• https://github.com/gogs/gogs/security/advisories/GHSA-pwx3-qcgw-vh7h

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50108The Naxclow platform API that returns device relay registrat…8.7
• CVE-2026-5011A vulnerability was detected in elecV2 elecV2P up to 3.8.3. …6.3
• CVE-2026-50110Storage Concentrator (SC & SCVM) contains hardcoded credenti…9.3
• CVE-2026-5012A flaw has been found in elecV2 elecV2P up to 3.8.3. This is…7.3
• CVE-2026-50124DataEase is an open source data visualization and analysis t…7.1
• CVE-2026-50127Weblate is a web based localization tool. From version 5.15 …5.9
• CVE-2026-50129Mastodon is a free, open-source social network server based …7.5
• CVE-2026-5013A vulnerability has been found in elecV2 elecV2P up to 3.8.3…5.5
• CVE-2026-50130Pi-hole is a DNS sinkhole that protects devices from unwante…8.8
• CVE-2026-50131Fedify is a TypeScript library for building federated server…8.6
• CVE-2026-50132Budibase is an open-source low-code platform. Prior to 3.39.…7.3
• CVE-2026-50133Hugo is a static site generator. Prior to 0.162.0, Hugo acce…6.1