Mastodon, an open-source social network server using ActivityPub, had insufficient protection in its handling of incoming activities signed with Linked-Data Signatures before versions 4.5.10, 4.4.17, and 4.3.23. The normalization process did not adequately protect the integrity of JSON entries within these signed activities, allowing attackers to remove entries from valid signed data originating from third-party actors. This vulnerability enables a class of spoofing attacks by manipulating signed activity content. The vulnerability is addressed by fixes in the specified versions.

An attacker can remove JSON entries from valid signed activities, potentially spoofing or altering the content of activities received by Mastodon servers. This undermines the integrity of signed data and could affect trust in federated communications. There is no indication of known exploits in the wild at this time.

Upgrade Mastodon to version 4.5.10, 4.4.17, or 4.3.23 or later, where this vulnerability has been fixed. No other mitigation is indicated by the vendor advisory.