PT-2025-8976 · Mastodon · Mastodon

227Abdulrahuman · Published 2025-02-27 · Updated 2025-03-02 · CVE-2025-27157

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.0 through 4.2.15 Mastodon versions 4.3.0 through 4.3.3

Description The issue concerns missing rate limits on the "/auth/setup" API endpoint, allowing an attacker to send emails to arbitrary addresses by crafting specific requests.

Recommendations For Mastodon versions 4.2.0 through 4.2.15, update to version 4.2.16 or later. For Mastodon versions 4.3.0 through 4.3.3, update to version 4.3.4 or later. As a temporary workaround, consider restricting access to the "/auth/setup" endpoint until a patch is available.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-MASTODON-2025-27157

CVE-2025-27157

GHSA-V39F-C9JJ-8W7H

Affected Products

Mastodon

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27157.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-v39f-c9jj-8w7h · Vendor Advisory
• https://github.com/mastodon/mastodon/commit/06f879ce9bea195344ac9f71e6799eea500628ec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-27157 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27157 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2025-27157 · Vendor Advisory
• https://twitter.com/WolfgangSesin/status/1895404309430288749 · Twitter Post
• https://t.me/cvedetector/19050 · Telegram Post
• https://twitter.com/CVEnew/status/1895241181455622507 · Twitter Post