Skip to content
Joinmastodon vulnerabilities
Newest
-
joinmastodon mastodon
Mastodon: Insufficient verification of email addresses
CVE-2026-41259
Fix available
8.2 High
-
joinmastodon mastodon
Mastodon has a denial of service for quote authorization
CVE-2026-33869
Fix available
4.8 Medium
-
joinmastodon mastodon
Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
CVE-2026-33868
Fix available
4.3 Medium
-
joinmastodon mastodon
Mastodon has SSRF via unvalidated FASP Provider base_url
CVE-2026-27477
Fix available
4.6 Medium
-
joinmastodon mastodon
Mastodon may allow unconfirmed FASP to make subscriptions
CVE-2026-27468
Fix available
4.8 Medium
-
joinmastodon mastodon
Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)
CVE-2026-25540
Fix available
6.5 Medium
-
joinmastodon mastodon
Mastodon has insufficient access control to push notification settings
CVE-2026-23964
Fix available
6.5 Medium
-
joinmastodon mastodon
Mastodon missing length limits on list names, filter names, and filter keywords
CVE-2026-23963
Fix available
4.3 Medium
-
joinmastodon mastodon
Mastodon vulnerable to Denial of Service from a single post (client/server)
CVE-2026-23962
Fix available
7.5 High
-
joinmastodon mastodon
Mastodon may allow a remote suspension bypass
CVE-2026-23961
Fix available
5.3 Medium
-
joinmastodon mastodon
Local Mastodon users can enumerate and access severed relationships of every other local user
CVE-2026-22246
Fix available
6.5 Medium
-
joinmastodon mastodon
Mastodon has SSRF Protection bypass
CVE-2026-22245
Fix available
7.1 High
-
joinmastodon mastodon
Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration
CVE-2025-67500
Fix available
3.7 Low
-
joinmastodon mastodon
Mastodon quotes control can be bypassed
CVE-2025-62605
Fix available
4.3 Medium
-
joinmastodon mastodon
Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels
CVE-2025-62176
Fix available
4.3 Medium
-
joinmastodon mastodon
Mastodon streaming API fails to disconnect disabled and suspended users
CVE-2025-62175
Fix available
4.3 Medium
-
joinmastodon mastodon
Mastodon allows continued access after password reset via CLI
CVE-2025-62174
Fix available
3.5 Low
-
joinmastodon mastodon
Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
CVE-2025-54879
Fix available
5.3 Medium
-
joinmastodon mastodon
Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"
CVE-2025-27399
Fix available
5.3 Medium
-
joinmastodon mastodon
Mastodon's rate-limits are missing on `/auth/setup`
CVE-2025-27157
Fix available
5.3 Medium
-
joinmastodon mastodon
Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.
CVE-2023-49952
Fix available
7.5 High
-
joinmastodon mastodon
In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request...
CVE-2024-34535
Fix available
5.9 Medium
-
joinmastodon mastodon
Mastodon has improper authorship check on audience extension for existing posts
CVE-2024-37903
Fix available
8.2 High
-
joinmastodon mastodon
Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
CVE-2024-25623
Fix available
8.5 High
-
joinmastodon mastodon
Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon
CVE-2024-25619
Fix available
3.1 Low
-
joinmastodon mastodon
External OpenID Connect Account Takeover by E-Mail Change in mastodon
CVE-2024-25618
Fix available
4.2 Medium
-
joinmastodon mastodon
Mastodon Remote user impersonation and takeover
CVE-2024-23832
Fix available
9.4 Critical
-
joinmastodon mastodon
Mastodon vulnerable to Stored XSS through the translation feature
CVE-2023-42452
Fix available
6.1 Medium
-
joinmastodon mastodon
Mastodon Invalid Domain Name Normalization vulnerability
CVE-2023-42451
Fix available
7.4 High
-
joinmastodon mastodon
Mastodon Server-Side Request Forgery vulnerability
CVE-2023-42450
Fix available
5.4 Medium
-
joinmastodon mastodon
Mastodon's verified profile links can be formatted in a misleading way
CVE-2023-36462
Fix available
5.4 Medium
-
joinmastodon mastodon
Mastodon vulnerable to Denial of Service through slow HTTP responses
CVE-2023-36461
Fix available
7.5 High
-
joinmastodon mastodon
Mastodon vulnerable to arbitrary file creation through media attachments
CVE-2023-36460
Fix available
EPSS 40.1%
10.0 Critical
-
joinmastodon mastodon
Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards
CVE-2023-36459
Fix available
9.3 Critical
-
joinmastodon mastodon
Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
CVE-2023-28853
Fix available
7.7 High
-
joinmastodon mastodon
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon...
CVE-2022-48364
Fix available
4.3 Medium
-
joinmastodon mastodon
Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue)...
CVE-2022-46405
Fix available
7.5 High
-
joinmastodon mastodon, mastodon mastodon/mastodon +1 more
Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
CVE-2022-2166
Fix available
9.8 Critical
-
joinmastodon mastodon
app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
CVE-2022-31263
Fix available
5.3 Medium
-
joinmastodon mastodon
Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not...
CVE-2022-24307
Fix available
9.8 Critical
-
joinmastodon mastodon, mastodon mastodon/mastodon +1 more
Prototype Pollution in mastodon/mastodon
CVE-2022-0432
Fix available
7.4 High
-
joinmastodon mastodon
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
CVE-2018-21018
9.8 Critical