PT-2026-28106 · Mastodon · Mastodon

Theamanrawat · Publicado 2026-03-25 · Atualizado 2026-03-31 · CVE-2026-33868

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.8 Mastodon versions prior to 4.4.15 Mastodon versions prior to 4.3.21

Description Mastodon, a free and open-source social network server based on ActivityPub, contains an unauthenticated Open Redirect issue in the /web/* route. This is due to improper handling of URL-encoded path segments. An attacker can create a specially encoded URL that redirects users to an arbitrary external domain, potentially enabling phishing attacks and OAuth credential theft. The issue arises because URL-encoded slashes (%2F) bypass Rails path normalization and are interpreted as host-relative redirects.

Recommendations Update Mastodon to version 4.5.8 or later. Update Mastodon to version 4.4.15 or later. Update Mastodon to version 4.3.21 or later.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

BIT-MASTODON-2026-33868

CVE-2026-33868

GHSA-XQW8-4J56-5HJ6

Produtos afetados

Mastodon

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33868.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-xqw8-4j56-5hj6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33868 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037719410404925608 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-mastodon-2026-33868 · Aviso do Fabricante
• https://twitter.com/pdnuclei_bot/status/2036850636835406050 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33868 · Aviso do Fabricante