Streaming API Vulnerability in Mastodon Social Network Server

CVE-2025-62175

What is CVE-2025-62175?

In Mastodon, prior to versions 4.4.6, 4.3.14, and 4.2.27, there is a vulnerability where a user's account, when disabled or suspended, remains connected to the streaming API. As a result, these accounts can still receive real-time updates despite being inactive. This flaw compromises the expected effectiveness of moderation actions, as administrators anticipate a complete disconnection of such accounts from the platform. The issue was rectified in the aforementioned versions, and there are no available workarounds.

References