CVE-2025-62174

Mastodon allows continued access after password reset via CLI

State: Published
Severity: 3.5 Low
Published: Oct 13, 2025
Updated: Oct 14, 2025
Reserved: Oct 7, 2025

Description

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password has been reset. This issue has been patched in versions 4.2.27, 4.3.14, and 4.4.6. No known workarounds exist.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
mastodonmastodon	>= 4.4.0-beta.1, < 4.4.6Affected >= 4.3.0-beta.1, < 4.3.14Affected < 4.2.27Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.