CVE-2025-27157 Mastodon's rate-limits are missing on `/auth/setup`

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...

CVE-2025-27157 Mastodon's rate-limits are missing on `/auth/setup`

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...

CVE-2025-27157

Mastodon rate-limits are missing on /auth/setup in versions 4.2.0–4.2.15 and 4.3.0–4.3.3, enabling an attacker to craft requests that send emails to arbitrary addresses. The issue is fixed in 4.2.16 and 4.3.4. This CVE description documents the affected versions and the remediation. If exploiting...

CVE-2024-9334

creationtimestamp| type| source ---|---|--- 2025-02-27 15:23:56+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114076538403107122 2025-02-27 15:48:32+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114076635029385494 2025-02-27 16:45:05+00:00| seen|...

CVE-2025-1717

creationtimestamp| type| source ---|---|--- 2025-02-27 09:48:19+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114075218651181708 2025-02-27 10:22:16+00:00| seen| https://t.me/cvedetector/19026 2025-02-27 11:00:55+00:00| seen|...

CVE-2025-1282

creationtimestamp| type| source ---|---|--- 2025-02-27 08:26:41+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5658 2025-02-27 11:00:55+00:00| seen| Telegram/u5U5HkdsjVTNTjKDjqO60RM8YSduevD2fdfzdqTTMF2XVOk 2025-02-27 11:48:30+00:00| seen|...

Mastodon 安全漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A security vulnerability exists in Mastodon that stems from a lack of rate limiting in /auth/setup, which could result in sending emails to arbitrary addresses...

Mastodon 授权问题漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. An authorization issue vulnerability exists in Mastodon that stems from an unapproved user being able to view the reason for a domain block, affecting instance administrators who do not wish to make...

CVE-2025-25517

creationtimestamp| type| source ---|---|--- 2025-02-26 01:13:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lj276afptc2v 2025-02-26 01:44:43+00:00| seen| https://t.me/cvedetector/18929 2025-02-26 19:49:10+00:00| seen|...

CVE-2025-27142

creationtimestamp| type| source ---|---|--- 2025-02-25 20:23:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/5375 2025-02-25 23:14:27+00:00| seen| https://t.me/cvedetector/18925 2025-02-28 15:49:14+00:00| seen|...

CVE-2025-26752

creationtimestamp| type| source ---|---|--- 2025-02-25 17:48:55+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114065783798975123...

CVE-2025-26915

creationtimestamp| type| source ---|---|--- 2025-02-25 17:43:03+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lizfyjursj2l 2025-02-25 17:48:56+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114065783890193318...

CVE-2025-26985

creationtimestamp| type| source ---|---|--- 2025-02-25 17:22:39+00:00| seen| https://t.me/cvedetector/18867 2025-02-25 17:48:59+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114065784094507463 2025-08-22 17:25:06+00:00| seen| MISP/8e1b6542-ae86-4729-a7a6-4e9f670b8bb7...

CVE-2025-1674

creationtimestamp| type| source ---|---|--- 2025-02-25 09:01:42+00:00| published-proof-of-concept| Telegram/yKpLY-2F8rkEOUTUq6LWKwJhxpg13wwviIMmbyTTpOtBuI 2025-02-25 09:02:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3liyivjtpxo2r 2025-02-25 09:48:47+00:00| seen|...

CVE-2025-22974

creationtimestamp| type| source ---|---|--- 2025-02-24 23:28:02+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/5236 2025-02-25 02:19:26+00:00| seen| https://t.me/cvedetector/18840 2025-02-25 17:48:53+00:00| seen|...

CVE-2024-53544

creationtimestamp| type| source ---|---|--- 2025-02-24 23:27:57+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5233 2025-02-25 02:19:32+00:00| seen| https://t.me/cvedetector/18844 2025-02-25 02:57:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lixujrlndi22 2025-02-25...

CVE-2025-26525

creationtimestamp| type| source ---|---|--- 2025-02-24 20:22:16+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5214 2025-02-24 21:48:28+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114061063378286532 2025-02-24 22:08:31+00:00| seen| https://t.me/cvedetector/18822 2025-02-...

CVE-2024-12918

creationtimestamp| type| source ---|---|--- 2025-02-24 17:21:56+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5189 2025-02-24 17:48:28+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114060119765999360 2025-02-24 19:32:23+00:00| seen|...

CVE-2024-12917

creationtimestamp| type| source ---|---|--- 2025-02-24 17:21:54+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5186 2025-02-24 17:48:27+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114060119701091927 2025-02-24 19:32:25+00:00| seen|...

CVE-2024-12916

creationtimestamp| type| source ---|---|--- 2025-02-24 14:22:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5139 2025-02-24 17:48:26+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114060119642533027 2025-02-24 19:32:26+00:00| seen|...