CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.

• CWE-348

• https://codeberg.org/forgejo/forgejo/issues/14271#issuecomment-22548004

Published

Sep 13, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90650The MotoPress Hotel Booking plugin for WordPress is vulnerab…7.2
• CVE-2026-90651Socket Firewall (socketdev/socket-registry-firewall) in regi…8.1
• CVE-2026-9066The WP Compress WordPress plugin before 7.10.04 does not va…6.1
• CVE-2026-90668The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7…7.5
• CVE-2026-9067The Schema & Structured Data for WP & AMP WordPress plugin b…9.1
• CVE-2026-90678An issue was discovered in HAProxy 3.3.0 through 3.4.4 and i…7.5
• CVE-2026-90680A security flaw has been discovered in D-Link DIR-823G 1.0.2…9.9
• CVE-2026-90681A weakness has been identified in Matthias-Wandel jhead up t…3.3
• CVE-2026-90682A security vulnerability has been detected in Matthias-Wande…5.3
• CVE-2026-90683A vulnerability was detected in GPAC up to f1219cde. Affecte…3.3
• CVE-2026-90684A flaw has been found in GPAC up to f1219cde. Affected by th…2.8
• CVE-2026-90685A vulnerability has been found in GPAC up to f1219cde. Affec…2.8