Joinmastodon Mastodon any version

Mastodon vulnerable to arbitrary file creation through media attachments

Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

Mastodon Remote user impersonation and takeover

Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)

Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon

Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards

Lack of media type verification of Activity Streams objects allows impersonation of remote accounts

Mastodon has improper authorship check on audience extension for existing posts

Mastodon may allow unconfirmed FASP to make subscriptions

Mastodon: Insufficient verification of email addresses

Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database

Mastodon vulnerable to Denial of Service through slow HTTP responses

Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.

Mastodon Invalid Domain Name Normalization vulnerability

Mastodon vulnerable to Denial of Service from a single post (client/server)

Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.

Mastodon has SSRF Protection bypass

Prototype Pollution in mastodon/mastodon

External OpenID Connect Account Takeover by E-Mail Change in mastodon

Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)

Mastodon missing length limits on list names, filter names, and filter keywords

Local Mastodon users can enumerate and access severed relationships of every other local user

Mastodon has insufficient access control to push notification settings

Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'

Mastodon vulnerable to Stored XSS through the translation feature

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

Mastodon has SSRF via unvalidated FASP Provider base_url

Mastodon's verified profile links can be formatted in a misleading way

app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.

Mastodon may allow a remote suspension bypass

Mastodon's rate-limits are missing on `/auth/setup`

Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"

Mastodon has a denial of service for quote authorization

The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive.

Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon

Mastodon quotes control can be bypassed

Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels

Mastodon streaming API fails to disconnect disabled and suspended users

Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration