CVE-2026-50128

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.3.0 through 4.5.10 Mastodon versions 4.4.0 through 4.4.17

Description Mastodon is a free, open-source social network server based on ActivityPub. A flaw in the definition of the attributionDomains JSON-LD term makes Linked Data Signatures on the toot:attributionDomains property ineffective. This allows an attacker to arbitrarily modify the attributionDomains value of a legitimately signed Update activity and bypass signature verification, potentially leading to false attribution claims.

Recommendations Update to version 4.5.11. Update to version 4.4.18.