CVE Details
Basic Information
| Title | Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails |
|---|---|
| Type | cve |
| Published | 2025-08-05T23:39:59.130Z |
| Modified | 2025-08-05T23:39:59.130Z |
Product Information
| Vendor | mastodon |
|---|---|
| Product | mastodon |
| Version | >= 3.1.5, < 4.2.24 |
CVSS Information
| Base Score | 5.3 (MEDIUM) |
|---|---|
| Attack Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected Products
- mastodon mastodon >= 3.1.5, < 4.2.24
- mastodon mastodon >= 4.3.0, < 4.3.11
- mastodon mastodon >= 4.4.0, < 4.4.3
Additional Information
| CWE List | CWE-770 |
|---|---|
| Source | GitHub_M |
Description
Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon’s rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.