CVE-2025-27157: Joinmastodon Mastodon

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.

Affected products

• Joinmastodon Mastodon: from 4.2.0, before 4.2.16 (fixed in 4.2.16); from 4.3.0, before 4.3.4 (fixed in 4.3.4)

Published 2025-02-27. Last modified 2026-06-17.