BIT-mastodon-2026-50128: Mastodon: Spoofing of attribution domains
Mastodon versions from 4.3.0 up to but not including 4.4.18, and from 4.5.0 up to but not including 4.5.11, contain a vulnerability in the handling of attributionDomains in JSON-LD. This flaw allows an attacker to modify the attributionDomains value in a legitimately signed Update activity, bypassing Mastodon's signature verification and enabling spoofing of attribution domains. The issue is fixed in versions 4.4.18 and 4.5.11.
AI Analysis
Technical Summary
Mastodon, an open-source social network server, uses the attributionDomains JSON-LD term to credit article authors and prevent false attribution. Due to an error in the definition of attributionDomains, Linked Data Signatures on the toot:attributionDomains property are ineffective. This allows an attacker to alter the attributionDomains value of a legitimately signed Update activity, bypassing signature verification and enabling spoofing of attribution domains. The vulnerability affects versions >=4.3.0 <4.4.18 and >=4.5.0 <4.5.11 and is resolved in 4.4.18 and 4.5.11.
Potential Impact
An attacker can spoof attribution domains by modifying the attributionDomains value in signed Update activities, potentially misleading users about the true source or author of content. This undermines the integrity of attribution claims within Mastodon instances running affected versions.
Mitigation Recommendations
This vulnerability is fixed in Mastodon versions 4.4.18 and 4.5.11. Users and administrators should upgrade to at least these versions to remediate the issue. No other mitigation steps are indicated by the vendor advisory.
BIT-mastodon-2026-50128: Mastodon: Spoofing of attribution domains
Description
Mastodon versions from 4.3.0 up to but not including 4.4.18, and from 4.5.0 up to but not including 4.5.11, contain a vulnerability in the handling of attributionDomains in JSON-LD. This flaw allows an attacker to modify the attributionDomains value in a legitimately signed Update activity, bypassing Mastodon's signature verification and enabling spoofing of attribution domains. The issue is fixed in versions 4.4.18 and 4.5.11.
Affected software
pkg:bitnami/mastodonRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Mastodon, an open-source social network server, uses the attributionDomains JSON-LD term to credit article authors and prevent false attribution. Due to an error in the definition of attributionDomains, Linked Data Signatures on the toot:attributionDomains property are ineffective. This allows an attacker to alter the attributionDomains value of a legitimately signed Update activity, bypassing signature verification and enabling spoofing of attribution domains. The vulnerability affects versions >=4.3.0 <4.4.18 and >=4.5.0 <4.5.11 and is resolved in 4.4.18 and 4.5.11.
Potential Impact
An attacker can spoof attribution domains by modifying the attributionDomains value in signed Update activities, potentially misleading users about the true source or author of content. This undermines the integrity of attribution claims within Mastodon instances running affected versions.
Mitigation Recommendations
This vulnerability is fixed in Mastodon versions 4.4.18 and 4.5.11. Users and administrators should upgrade to at least these versions to remediate the issue. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-mastodon-2026-50128
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-50128"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
- Cvss Version
- null
Threat ID: 6a4c347427e9c79719603a93
Added to database: 07/06/2026, 23:04:20 UTC
Last enriched: 07/06/2026, 23:36:58 UTC
Last updated: 08/21/2026, 02:19:15 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.