BIT-mastodon-2025-27157

vendorUSosv

Mastodon's rate-limits are missing on `/auth/setup`

view advisory published 2025-03-02Licence: per source

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-27157US	medium5.3	0.37% (31st)	—	2025-02-27
Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without…

references

External citations — patches, advisories, analysis.

https://github.com/mastodon/mastodon/commit/06f879ce9bea195344ac9f71e6799eea500628ecFIX
https://github.com/mastodon/mastodon/security/advisories/GHSA-v39f-c9jj-8w7hADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-27157WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan