Skip to content
Threat Feed
Subscribe

Tag

Federation

3 briefs RSS
high advisory

CVE-2026-58593: NodeBB ActivityPub Forgery Vulnerability

A critical vulnerability (CVE-2026-58593) in NodeBB's ActivityPub implementation allows a remote attacker to forge posts and direct messages attributed to arbitrary local users, including administrators, by manipulating the 'attributedTo' field in inbound ActivityPub objects.

PoC NodeBB +1 activitypub federation vulnerability web-application cms forgery
1t 1c updated
critical advisory

Azure AD User ImmutableId Attribute Modification for Persistence

Attackers modify the ImmutableID attribute of an Azure AD user to establish a federation backdoor, bypassing MFA and enabling persistent access.

Azure Active Directory azuread persistence federation immutabilid
2r 1t
medium advisory

Azure Domain Federation Settings Modified

An attacker may modify Azure domain federation settings to establish persistence, escalate privileges, or gain unauthorized access to resources.

Azure Active Directory azure federation privilege-escalation persistence initial-access
2r 2t