CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.

• CWE-348

• https://codeberg.org/forgejo/forgejo/issues/14271#issuecomment-22548004

Published

Sep 13, 2026

Last Modified

Sep 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9065SureCart version prior to 4.2.1 are vulnerable to authentica…9.3
• CVE-2026-90651Socket Firewall (socketdev/socket-registry-firewall) in regi…8.1
• CVE-2026-9066The WP Compress WordPress plugin before 7.10.04 does not va…6.1
• CVE-2026-90668The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7…7.5
• CVE-2026-9067The Schema & Structured Data for WP & AMP WordPress plugin b…9.1
• CVE-2026-90678An issue was discovered in HAProxy 3.3.0 through 3.4.4 and i…7.5
• CVE-2026-9071IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSph…7.5
• CVE-2026-9072IBM WebSphere Application Server and IBM WebSphere Applicati…9.8
• CVE-2026-9073A flaw was found in foreman-mcp-server. This component utili…6.2
• CVE-2026-9074IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 throu…9.8
• CVE-2026-9076Issue summary: When CMS password-based decryption (RFC 3211 …7.5
• CVE-2026-9077IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote…8.5