What’s Vulnerable › Vulnerabilities

CVE-2024-23832: Mastodon Remote user impersonation and takeover

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-01 · updated 2026-06-17
• Weakness: CWE-290

Description

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.

Affected products

• mastodon: before 3.5.17; from 4.0.0 before 4.0.13; from 4.1.0 before 4.1.13; from 4.2.0 before 4.2.5 — fixed in 3.5.17, 4.0.13, 4.1.13, 4.2.5

How to fix

Upgrade to a fixed version: mastodon 3.5.17, 4.0.13, 4.1.13, 4.2.5. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/02/02/4
• https://github.com/mastodon/mastodon/commit/1726085db5cd73dd30953da858f9887bcc90b958
• https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw
• http://www.openwall.com/lists/oss-security/2024/02/02/4
• https://github.com/mastodon/mastodon/commit/1726085db5cd73dd30953da858f9887bcc90b958
• https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw

Get alerted when CVE-2024-23832 or the next vulnerability affects your stack