Password Reset Vulnerability in Mastodon Open Source Social Media Platform

CVE-2025-62174

What is CVE-2025-62174?

In earlier versions of the Mastodon social media platform, an issue exists where an administrator’s password reset action does not revoke active sessions and access tokens. This oversight allows an attacker, who may have previously gained access to a compromised session or token, to retain access to the user account even after the password has been changed. This vulnerability has been addressed in subsequent updates, and upgrading to the latest versions is essential to mitigate this security risk. There are currently no workarounds available.

References