Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow… (CVE-2026-90679)
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.
AI Analysis
Technical Summary
Forgejo versions 13.0.0 through 16.0.4, when the federation feature is enabled, contain a spoofing vulnerability (CVE-2026-90679) affecting identity integrity. The implementation verifies the HTTP Signature on incoming ActivityPub activities but fails to bind the verified signing key to the actor identity specified in the activity body. Additionally, the Digest header signature is not recomputed against the actual request body. This allows a remote attacker who controls a single valid ActivityPub actor and keypair to submit signature-valid activities impersonating any actor identity. The vulnerability does not allow account takeover or content modification.
Potential Impact
The vulnerability impacts identity integrity by allowing spoofing of actor identities in ActivityPub activities. It does not enable attackers to take over accounts or modify content. This could lead to misleading or fraudulent activity attribution within federated environments using Forgejo.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware of the risk when federation is enabled and monitor for suspicious activity. No official fix or patch links are currently provided.
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow… (CVE-2026-90679)
Description
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/forgejo/forgejoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Forgejo versions 13.0.0 through 16.0.4, when the federation feature is enabled, contain a spoofing vulnerability (CVE-2026-90679) affecting identity integrity. The implementation verifies the HTTP Signature on incoming ActivityPub activities but fails to bind the verified signing key to the actor identity specified in the activity body. Additionally, the Digest header signature is not recomputed against the actual request body. This allows a remote attacker who controls a single valid ActivityPub actor and keypair to submit signature-valid activities impersonating any actor identity. The vulnerability does not allow account takeover or content modification.
Potential Impact
The vulnerability impacts identity integrity by allowing spoofing of actor identities in ActivityPub activities. It does not enable attackers to take over accounts or modify content. This could lead to misleading or fraudulent activity attribution within federated environments using Forgejo.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware of the risk when federation is enabled and monitor for suspicious activity. No official fix or patch links are currently provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5cjj-j77f-rq2g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90679"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6aa741aa55bf5e2cf548a605
Added to database: 09/14/2026, 00:36:58 UTC
Last enriched: 09/14/2026, 00:44:24 UTC
Last updated: 09/14/2026, 02:07:37 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.