Authentication Bypass

Fedify is vulnerable to authentication bypass. The vulnerability is due to processing forged activities before verifying that the signing key belongs to the claimed actor, which allows an attacker to impersonate any ActivityPub actor across all Fedify instances...