CVE-2026-59825

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

CVE-2026-59825

When LDAP auth uses LDAP_TLS_NO_VERIFY=true, app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS, disabling SSL/TLS verification globally for puma web processes. This enables MITM attacks against all puma-originated HTTPS requests. Fixed in Mastodon 4.4...

CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...