CVE-2023-49095

nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

State: Published
Severity: 8.6 High
Published: Nov 30, 2023
Updated: Nov 27, 2024
Reserved: Nov 21, 2023

Description

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
nexkeynexryai	< 12.122.2Affected

References

https://github.com/nexryai/nexkey/security/advisories/GHSA-fpxw-rw9v-2gmx
https://github.com/nexryai/nexkey/commit/b96da0eac5a1e75abba94cf926f1251842829bab

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.