CVE-2026-46349

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.10 Mastodon versions prior to 4.4.17 Mastodon versions prior to 4.3.23

Description Mastodon is a free, open-source social network server based on ActivityPub. The normalization of incoming activities signed with Linked-Data Signatures (a method for signing data in a way that allows it to be verified even if the data is restructured) does not sufficiently protect activities from a specific class of spoofing. This allows attackers to re-arrange a valid signed JSON-LD activity from a third-party actor to ensure it is processed differently by the server.

Recommendations Update to version 4.5.10. Update to version 4.4.17. Update to version 4.3.23.