Missing Rate Limits in Mastodon's Authentication Setup Process
CVE-2025-27157
5.3MEDIUM
What is CVE-2025-27157?
Mastodon, a self-hosted federated microblogging platform, is affected by a vulnerability due to the absence of rate limits on the /auth/setup endpoint. This flaw allows an attacker to manipulate requests and send emails to arbitrary addresses, potentially leading to misuse of the email notification system. The issue has been rectified in versions 4.2.16 and 4.3.4, reinforcing the need for users to promptly update their installations to ensure email functionalities are secured against unauthorized use.
Affected Version(s)
mastodon >= 4.2.0, < 4.2.16 < 4.2.0, 4.2.16
mastodon >= 4.3.0, < 4.3.4 < 4.3.0, 4.3.4