medium5.3
CVE-2025-27157
Mastodon is a self-hosted, federated microblogging platform.
Impact
Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Joinmastodon | Mastodon | from 4.2.0 before 4.2.16 from 4.3.0 before 4.3.4 |