What is CVE-2025-54888?

CVE-2025-54888 is a vulnerability in Fedify-dev Fedify, classified under Improper Authentication. Published 2025-08-09.

Is CVE-2025-54888 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Fedify-dev Fedify

CVE-2025-54888

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and…

Vulnerability class: Broken Authentication

EPSS: 0.006 (44.4th percentile) — read the EPSS interpretation.

Affected products

Fedify-dev Fedify — versions < 1.3.20, >= 1.4.0-dev.585, < 1.4.13, >= 1.5.0-dev.636, < 1.5.5

Weakness classification (CWE)

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-54888?: CVE-2025-54888 is a vulnerability in Fedify-dev Fedify, classified under Improper Authentication. Published 2025-08-09.
Is CVE-2025-54888 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.