CVE-2024-25618: mastodon Auth Bypass

Description

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication provider allows changing the e-mail address or multiple authentication providers are configured. When a user logs in through an external authentication provider for the first time, Mastodon checks the e-mail address passed by the provider to find an existing account. However, using the e-mail address alone means that if the authentication provider allows changing the e-mail address of an account, the Mastodon account can immediately be hijacked. All users logging in through external authentication providers are affected. The severity is medium, as it also requires the external authentication provider to misbehave. However, some well-known OIDC providers (like Microsoft Azure) make it very easy to accidentally allow unverified e-mail changes. Moreover, OpenID Connect also allows dynamic client registration. This issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Is your site exposed to CVE-2024-25618?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.2

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness Type (CWE)

CWE-287 Improper Authentication

CWE-306 Missing Authentication

Affected Products

Vendor	Product	Versions
joinmastodon	mastodon	< 3.5.18
joinmastodon	mastodon	4.0.0 — 4.0.14
joinmastodon	mastodon	4.1.0 — 4.1.14
joinmastodon	mastodon	4.2.0 — 4.2.6

References

Advisories & Patches

https://github.com/mastodon/mastodon/commit/b31af34c9716338e4a32a62cc812d1ca59e88d15 https://github.com/mastodon/mastodon/security/advisories/GHSA-vm39-j3vx-pch3 https://github.com/mastodon/mastodon/commit/b31af34c9716338e4a32a62cc812d1ca59e88d15 https://github.com/mastodon/mastodon/security/advisories/GHSA-vm39-j3vx-pch3

Exploits

https://github.com/mastodon/mastodon/security/advisories/GHSA-vm39-j3vx-pch3 https://github.com/mastodon/mastodon/security/advisories/GHSA-vm39-j3vx-pch3

Frequently Asked Questions

What is CVE-2024-25618? +

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication provider allows changing the e-mail address or multiple authentication providers are configured. When a user logs in through an external authentication provider for the first time, Mastodon checks the e-mail address passed by the provider to find an existing account. However, using the e-mail address alone means that if the authentication provider allows changing the e-mail address of an account, the Mastodon account can immediately be hijacked. All users logging in through external authentication providers are affected. The severity is medium, as it also requires the external authentication provider to misbehave. However, some well-known OIDC providers (like Microsoft Azure) make it very easy to accidentally allow unverified e-mail changes. Moreover, OpenID Connect also allows dynamic client registration. This issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability. It has a CVSS v3.1 base score of 4.2 (MEDIUM).

How severe is CVE-2024-25618? +

CVE-2024-25618 has a CVSS v3.1 score of 4.2 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-25618? +

CVE-2024-25618 affects products from joinmastodon, specifically: mastodon. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-25618? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-47202

Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated …

CVE-2026-61740

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, …

CVE-2026-47159

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO …

CVE-2026-44720

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX …

CVE-2025-24032

PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy …

CVE-2024-5174

A flaw in Gliffy results in broken authentication through the reset functionality of the application.

CVE-2024-25618