Federation

NodeBB ActivityPub attributedTo Local UID Spoof

NodeBB's ActivityPub inbox authenticates the top-level signed actor of an incoming activity via HTTP Signatures, but never checks that the embedded Note.attributedTo field — used later as the internal local user id for chat message and post authorship —…