Description

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPubactivity was produced by the key belonging to the actor named in the activity body. The signature verification in routers/api/v1/activitypub/reqsignature.go validates the request signature, but the inbox activity handlers subsequently read the acting identity from the attacker-controlled JSON body without binding it to the verified signing key. Additionally, the signed Digest header is not recomputed against the received request body. A remote attacker who hosts a single valid ActivityPub actor and keypair can therefore submit signature-valid activities attributed to any actor identity they name.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-13T04:17:25.417Z",
  "pubdate": "2026-09-13T04:17:25.417Z",
  "executiveSummary": "Forgejo versions 13.0.0 through 16.0.4 are susceptible to an identity spoofing vulnerability within the ActivityPub federation module. When the [federation] ENABLED configuration is set to true, the application fails to cryptographically bind verified HTTP Signatures to the identity claimed within the ActivityPub JSON payload. This vulnerability stems from a logical decoupling between the request-level signature validation and the subsequent processing of actor identities in the inbox handlers.\nA remote attacker capable of hosting a valid ActivityPub actor and keypair can bypass integrity checks to impersonate arbitrary identities. By crafting malicious activities, the attacker can submit content attributed to any actor identity of their choosing, provided the attacker's own signature is valid for the transport layer. While this flaw does not facilitate direct account takeover or arbitrary content modification within the Forgejo database, it severely undermines the integrity of identity claims and trust within federated communications. The issue is persistent as long as the federation features remain enabled and the signature-to-actor binding logic remains unvalidated in the processing flow.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of ActivityPub request processing within routers/api/v1/activitypub/reqsignature.go. While the module correctly verifies the HTTP Signature of incoming requests, it treats the transport-layer signature as an isolated authentication event. The subsequent inbox activity handlers extract the actor identity directly from the attacker-controlled JSON body rather than cross-referencing the identity with the public key verified during the initial signature check.\nFurthermore, the system fails to perform a secondary validation of the Digest header. The signed Digest header is not recomputed or verified against the actual received request body, allowing an attacker to submit a payload that contains an arbitrary 'actor' field while still possessing a 'valid' signature from their own controlled domain.\nThe attack flow proceeds as follows: 1) The attacker provisions a legitimate ActivityPub actor and a valid cryptographic keypair on an external server under their control. 2) The attacker constructs a malicious ActivityPub activity where the 'actor' field identifies a target user or entity. 3) The attacker signs this request using their own private key, ensuring the HTTP Signature header is valid. 4) The attacker sends the request to the Forgejo instance. 5) Forgejo verifies the signature against the attacker's public key; since the signature is mathematically sound, the check passes. 6) The inbox handler parses the JSON, reads the attacker-defined 'actor' identity, and processes the activity as if it originated from the spoofed identity. 7) Because there is no cryptographic binding or mandatory check to ensure that the signing key corresponds to the actor identified in the activity body, the impersonation is accepted as legitimate.\nThis vulnerability is restricted to environments where [federation] ENABLED is set to true. No specific account privileges or local authentication are required for exploitation, as the vector is network-exposed via the ActivityPub protocol. Post-exploitation, the primary impact is the manipulation of identity perception in federated logs and notifications, potentially leading to social engineering or the degradation of trust mechanisms within the Forgejo federation ecosystem."
}