PT-2025-41807 · Mastodon · Mastodon

Thisismissem · Published 2025-10-13 · Updated 2025-10-20 · CVE-2025-62174

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.2.27 Mastodon versions prior to 4.3.14 Mastodon versions prior to 4.4.6

Description Mastodon is a free, open-source social network server based on ActivityPub. When an administrator resets a user account’s password using the command-line interface with bin/tootctl accounts modify --reset-password, active sessions and access tokens for that account are not revoked. This allows an attacker who previously compromised a session or token to continue using the account even after the password has been reset. The command used for password reset is bin/tootctl accounts modify --reset-password.

Recommendations Update to Mastodon version 4.2.27 or later. Update to Mastodon version 4.3.14 or later. Update to Mastodon version 4.4.6 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BIT-MASTODON-2025-62174

CVE-2025-62174

GHSA-F3Q3-RMF7-9655

Affected Products

Mastodon

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62174.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q3-rmf7-9655 · Vendor Advisory
• https://github.com/mastodon/mastodon/commit/1631fb80e8029d2c5425a03a2297b93f7e225217 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62174 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62174 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2025-62174 · Vendor Advisory
• https://twitter.com/CVEnew/status/1977845279576764915 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1977869724475080966 · Twitter Post
• https://t.me/cveNotify/139457 · Telegram Post