Mastodon vulnerabilities
46 CVEs and advisories name Mastodon as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-27157Mastodon's rate-limits are missing on `/auth/setup`
- CVE-2024-37903Mastodon has improper authorship check on audience extension for existing posts
- CVE-2024-25623Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
- CVE-2024-25619Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon
- CVE-2024-25618External OpenID Connect Account Takeover by E-Mail Change in mastodon
- CVE-2024-23832Mastodon Remote user impersonation and takeover
- CVE-2023-42452Mastodon vulnerable to Stored XSS through the translation feature
- CVE-2023-42451Mastodon Invalid Domain Name Normalization vulnerability
- CVE-2023-42450Mastodon Server-Side Request Forgery vulnerability
- CVE-2023-36462Mastodon's verified profile links can be formatted in a misleading way
- CVE-2023-36461Mastodon vulnerable to Denial of Service through slow HTTP responses
- CVE-2023-36460Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2023-36459Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards
- CVE-2023-28853Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
- CVE-2022-2166Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
- CVE-2022-0432Prototype Pollution in mastodon/mastodon