CVE-2026-48028

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.10 Mastodon versions prior to 4.4.17 Mastodon versions prior to 4.3.23

Description Mastodon is a free, open-source social network server based on ActivityPub. The normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect activities from a specific class of spoofing. This allows threat actors to remove JSON entries from valid signed activities originating from a third-party actor.

Recommendations Update to version 4.5.10. Update to version 4.4.17. Update to version 4.3.23.