CVE-2026-90679
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPubactivity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS probability
- 0.16%
- CWE
- CWE-348
- Published
- 2026-09-13
- Last modified
- 2026-09-15
Affected products
- Forgejo Forgejo
Weakness type
Related vulnerabilities
- CVE-2024-45410 — HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2025-59951 — Termix' official Docker image contains an authentication bypass vulnerability
- CVE-2025-48865 — Fabio allows HTTP clients to manipulate custom headers it adds
- CVE-2024-27773 — Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source
- CVE-2026-48772 — ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL
- CVE-2025-55292 — In Meshtastic, an attacker can spoof licensed amateur flag for a node
- CVE-2026-44183 — Cleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabled
- CVE-2021-21374 — Nimble fails to validate certificates due to insecure httpClient defaults