# cve.now: Mastodon

The newest entries naming Mastodon as an affected vendor (up to 200), of 46 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-59825](https://cve.now/CVE-2026-59825.md): Mastodon: Unwanted deactivation of SSL/TLS certificate verification (CVSS 7.4)
- [CVE-2026-72916](https://cve.now/CVE-2026-72916.md): Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses (CVSS 6.3)
- [CVE-2026-72915](https://cve.now/CVE-2026-72915.md): Mastodon: Personally-identifying information disclosure due to incorrect access control validation (CVSS 7.5)
- [CVE-2026-72914](https://cve.now/CVE-2026-72914.md): Mastodon: Exhausting data by an unauthenticated request to the admin retention API (CVSS 7.5)
- [CVE-2026-50129](https://cve.now/CVE-2026-50129.md): Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH\_TRANSFORMER (CVSS 7.5)
- [CVE-2026-50128](https://cve.now/CVE-2026-50128.md): Mastodon: Spoofing of attribution domains (CVSS 5.3)
- [CVE-2026-48028](https://cve.now/CVE-2026-48028.md): Mastodon: Removal of integrity-protected JSON entries from signed activities (CVSS 6.5)
- [CVE-2026-47389](https://cve.now/CVE-2026-47389.md): Mastodon: SSRF protection bypass on older Ruby versions (CVSS 8.6)
- [CVE-2026-46349](https://cve.now/CVE-2026-46349.md): Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring (CVSS 5.3)
- [CVE-2026-46348](https://cve.now/CVE-2026-46348.md): Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) (CVSS 8.7)
- [CVE-2026-47777](https://cve.now/CVE-2026-47777.md): Mastodon has a consent-check bypass in its remote Collections (CVSS 7.5)
- [CVE-2026-41259](https://cve.now/CVE-2026-41259.md): Mastodon: Insufficient verification of email addresses (CVSS 8.2)
- [CVE-2026-33869](https://cve.now/CVE-2026-33869.md): Mastodon has a denial of service for quote authorization (CVSS 4.8)
- [CVE-2026-33868](https://cve.now/CVE-2026-33868.md): Mastodon has a GET-Based Open Redirect via '/web/%2F\<domain\>' (CVSS 4.3)
- [CVE-2026-27477](https://cve.now/CVE-2026-27477.md): Mastodon has SSRF via unvalidated FASP Provider base\_url (CVSS 4.6)
- [CVE-2026-27468](https://cve.now/CVE-2026-27468.md): Mastodon may allow unconfirmed FASP to make subscriptions (CVSS 4.8)
- [CVE-2026-25540](https://cve.now/CVE-2026-25540.md): Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via \`Rails.cache\`) (CVSS 6.5)
- [CVE-2026-23964](https://cve.now/CVE-2026-23964.md): Mastodon has insufficient access control to push notification settings (CVSS 6.5)
- [CVE-2026-23963](https://cve.now/CVE-2026-23963.md): Mastodon missing length limits on list names, filter names, and filter keywords (CVSS 4.3)
- [CVE-2026-23962](https://cve.now/CVE-2026-23962.md): Mastodon vulnerable to Denial of Service from a single post (client/server) (CVSS 7.5)
- [CVE-2026-23961](https://cve.now/CVE-2026-23961.md): Mastodon may allow a remote suspension bypass (CVSS 5.3)
- [CVE-2026-22246](https://cve.now/CVE-2026-22246.md): Local Mastodon users can enumerate and access severed relationships of every other local user (CVSS 6.5)
- [CVE-2026-22245](https://cve.now/CVE-2026-22245.md): Mastodon has SSRF Protection bypass (CVSS 7.1)
- [CVE-2025-67500](https://cve.now/CVE-2025-67500.md): Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration (CVSS 3.7)
- [CVE-2025-62605](https://cve.now/CVE-2025-62605.md): Mastodon quotes control can be bypassed (CVSS 4.3)
- [CVE-2025-62176](https://cve.now/CVE-2025-62176.md): Mastadon streaming server allows OAuth clients without the \`read\` scope to subscribe to public channels (CVSS 4.3)
- [CVE-2025-62175](https://cve.now/CVE-2025-62175.md): Mastodon streaming API fails to disconnect disabled and suspended users (CVSS 4.3)
- [CVE-2025-62174](https://cve.now/CVE-2025-62174.md): Mastodon allows continued access after password reset via CLI (CVSS 3.5)
- [CVE-2025-54879](https://cve.now/CVE-2025-54879.md): Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails (CVSS 5.3)
- [CVE-2025-27399](https://cve.now/CVE-2025-27399.md): Mastodon's domain blocks & rationales ignore user approval when visibility set as "users" (CVSS 5.3)
- [CVE-2025-27157](https://cve.now/CVE-2025-27157.md): Mastodon's rate-limits are missing on \`/auth/setup\` (CVSS 5.3)
- [CVE-2024-37903](https://cve.now/CVE-2024-37903.md): Mastodon has improper authorship check on audience extension for existing posts (CVSS 8.2)
- [CVE-2024-25623](https://cve.now/CVE-2024-25623.md): Lack of media type verification of Activity Streams objects allows impersonation of remote accounts (CVSS 8.5)
- [CVE-2024-25619](https://cve.now/CVE-2024-25619.md): Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon (CVSS 3.1)
- [CVE-2024-25618](https://cve.now/CVE-2024-25618.md): External OpenID Connect Account Takeover by E-Mail Change in mastodon (CVSS 4.2)
- [CVE-2024-23832](https://cve.now/CVE-2024-23832.md): Mastodon Remote user impersonation and takeover (CVSS 9.4)
- [CVE-2023-42452](https://cve.now/CVE-2023-42452.md): Mastodon vulnerable to Stored XSS through the translation feature (CVSS 6.1)
- [CVE-2023-42451](https://cve.now/CVE-2023-42451.md): Mastodon Invalid Domain Name Normalization vulnerability (CVSS 7.4)
- [CVE-2023-42450](https://cve.now/CVE-2023-42450.md): Mastodon Server-Side Request Forgery vulnerability (CVSS 5.4)
- [CVE-2023-36462](https://cve.now/CVE-2023-36462.md): Mastodon's verified profile links can be formatted in a misleading way (CVSS 5.4)
- [CVE-2023-36461](https://cve.now/CVE-2023-36461.md): Mastodon vulnerable to Denial of Service through slow HTTP responses (CVSS 7.5)
- [CVE-2023-36460](https://cve.now/CVE-2023-36460.md): Mastodon vulnerable to arbitrary file creation through media attachments (CVSS 10.0)
- [CVE-2023-36459](https://cve.now/CVE-2023-36459.md): Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards (CVSS 9.3)
- [CVE-2023-28853](https://cve.now/CVE-2023-28853.md): Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database (CVSS 7.7)
- [CVE-2022-2166](https://cve.now/CVE-2022-2166.md): Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon (CVSS 9.8)
- [CVE-2022-0432](https://cve.now/CVE-2022-0432.md): Prototype Pollution in mastodon/mastodon (CVSS 7.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mastodon
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.