nexkey allows arbitrary users to impersonate any remote user due to missing signature validation
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.6%
exploitation probability
0.6%top 56% of all CVEs
observed exploitation
nono source reports it
nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
nexryai · nexkey