CVE-2024-23832

Mastodon Remote user impersonation and takeover

State: Published
Severity: 9.4 Critical
Published: Feb 1, 2024
Updated: Feb 13, 2025
Reserved: Jan 22, 2024

Description

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.

Scores

CVSS	Score	Vector	Source
3.1	9.4 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H	GitHub_M

Weaknesses

CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
mastodonmastodon	< 3.5.17Affected >= 4.0.0, < 4.0.13Affected >= 4.1.0, < 4.1.13Affected >= 4.2.0, < 4.2.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.