CVE-2023-49095 HIGH

CVE-2023-49095: nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

Vendor Nexryai
Product nexkey
Weakness CWE-20 · Input validation
Published November 30, 2023
Last update November 27, 2024
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.

Key dates

02Disclosure timeline

November 30, 2023 CVE published
November 27, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-61583 TS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handling CVE-2024-8518 CVE-2026-40162 Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble CVE-2026-3460 REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter CVE-2024-9257 Logsign Unified SecOps Platform delete_gsuite_key_file Input Validation Arbitrary File Deletion Vulnerability