The vulnerability lies in Mastodon's handling of the attributionDomains JSON‑LD term used to credit authors in linked data signatures. An error in this definition causes the signature verification on the toot:attributionDomains property to fail, allowing an attacker to modify the attributionDomains value of a legitimately signed Update activity. As a result, malicious actors can forge author attribution, causing content to be misattributed to any domain they choose. This attack undermines authenticity and can be used for misinformation or impersonation of legitimate authors.

The issue affects all Mastodon server releases from version 4.3.0 through the unreleased patch up to version 4.5.10 and all older releases prior to the fixed revisions 4.5.11 and 4.4.18. The vulnerability is resolved in the 4.5.11 and 4.4.18 releases.

The CVSS score of 5.3 places this vulnerability in the moderate severity range. The EPSS score is not available, and it is not listed in the CISA KEV catalog. An attacker would need to craft a signed Update activity – likely through the official API or a custom client – and supply a false attributionDomains value. The attack can be carried out remotely by an authenticated user with the ability to publish updates, and the impact is limited to the misattribution of content rather than arbitrary code execution or system compromise.