Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

CVE Details

Basic Information

Title Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
Type cve
Published 2025-08-05T23:39:59.130Z
Modified 2025-08-05T23:39:59.130Z

Product Information

Vendor mastodon
Product mastodon
Version >= 3.1.5, < 4.2.24

CVSS Information

Base Score 5.3 (MEDIUM)
Attack Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products

  • mastodon mastodon >= 3.1.5, < 4.2.24
  • mastodon mastodon >= 4.3.0, < 4.3.11
  • mastodon mastodon >= 4.4.0, < 4.4.3

Additional Information

CWE List CWE-770
Source GitHub_M

Description

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon’s rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.