CVE-2025-62174
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password reset. The issue is patched in 4.2.27, 4.3.14, and 4.4.6; no known workarounds exist.
Risk Assessment
If an account was compromised, an administrator password reset will not cut off the attacker who can still use an active session or token. This may lead to continued unauthorized access to the account and data.
Recommendation
Update Mastodon to version 4.2.27, 4.3.14, or 4.4.6. After a password reset, manually revoke the user's active sessions and tokens.
Other vulnerabilities in Mastodon
See all- CVE-2026-22245High
Mastodon, a free, open-source social network server based on ActivityPub, has a vulnerability in its protection mechanism that blocks requests to local IP addresses. Some IP address ranges are missing, allowing an attacker to make Mastodon perform HTTP requests against loopback or local network hosts, potentially accessing private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29.
- CVE-2023-36460Critical
Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to create and overwrite arbitrary files in the system through carefully crafted media files. This affects versions from 3.5.0 to 3.5.8 and 4.0.0 to 4.1.2.
- CVE-2023-36459Critical
Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to bypass HTML sanitization using crafted oEmbed data. This enables the injection of arbitrary HTML into oEmbed preview cards, creating a vector for XSS attacks.
- CVE-2026-59825High
Vulnerability in Mastodon prior to versions 4.4.19 and 4.5.12. The ldap_authenticable.rb file mutates global OpenSSL parameters when LDAP uses LDAP_TLS_NO_VERIFY=true, disabling SSL/TLS certificate verification for puma web processes.
- CVE-2026-72916Medium
In Mastodon before versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? does not recognize IPv4-compatible IPv6 addresses, allowing an attacker to bypass ALLOWED_PRIVATE_ADDRESSES protection and send HTTP requests to loopback interfaces, potentially accessing private resources. Exploitation requires a system supporting the obsolete IPv4-compatible IPv6 mechanism.
- CVE-2026-72915High
Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.
- CVE-2026-72914High
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.
- CVE-2026-50129High
Mastodon prior to versions 4.5.11, 4.4.18, and 4.3.24 contains a DoS vulnerability due to missing exception handling in the math sanitizer. Malformed <math> nodes can lead to a DoS of the entire server or targeted user services, depending on the actions involving those nodes.
- CVE-2026-50128Medium
Mastodon, a social network server based on ActivityPub, has a vulnerability in versions from 4.3.0 to 4.5.11 and 4.4.18 that allows modification of the attributionDomains value in signed activities. An error in the definition of this term makes Linked Data signatures ineffective.
- CVE-2026-48028Medium
Prior to versions 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures did not adequately protect against a certain class of spoofing, allowing threat actors to remove JSON entries from valid signed activities from third-party actors.
Original NVD description (English source)
Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password has been reset. This issue has been patched in versions 4.2.27, 4.3.14, and 4.4.6. No known workarounds exist.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS