Mastodon normalizes JSON‑LD signed activities to guard against tampering. Before versions 4.5.10, 4.4.17, and 4.3.23 the normalization step did not fully protect against a class of spoofing attacks. An attacker can rearrange a legitimate signed JSON‑LD activity from a trusted actor so that it is interpreted differently by the receiving server. This bypass allows the attacker to impersonate the actor or perform unauthorized actions under the guise of a valid signature.

The product affected is the Mastodon social‑network server. All instances running a version older than 4.5.10, 4.4.17, or 4.3.23 are vulnerable. Upgrading to any of those releases or a later one removes the flaw.

The CVSS score of 5.3 indicates a moderate overall risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. The flaw operates on inbound signed messages, so attackers would need network access to send crafted ActivityPub traffic. Because the vulnerability is only present in older releases, an immediate patch considerably reduces the possibility of exploitation.