CVE-2025-54879: Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5…

PriorityP348high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.50%

39.3th percentile

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
joinmastodon	mastodon	>= 3.1.5 < 4.2.24	4.2.24
joinmastodon	mastodon	>= 4.3.0 < 4.3.11	4.3.11
joinmastodon	mastodon	>= 4.4.0 < 4.4.3	4.4.3
mastodon	mastodon	—	—
mastodon	mastodon	—	—
mastodon	mastodon	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.