CVE-2025-27157

5.3 mediumEPSS 0.4%

Medium (5.3) in joinmastodon mastodon. EPSS 0.4% chance of exploitation in the next 30 days.

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2025-02-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

joinmastodon:mastodon

References

https://github.com/mastodon/mastodon/commit/06f879ce9bea195344ac9f71e6799eea500628ec
https://github.com/mastodon/mastodon/security/advisories/GHSA-v39f-c9jj-8w7h

Check your stack JSON