CVE-2025-62174
Description
Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password has been reset. This issue has been patched in versions 4.2.27, 4.3.14, and 4.4.6. No known workarounds exist.
How to fix
- joinmastodon mastodon4.2.27, 4.3.14, 4.4.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joinmastodon mastodon | v < 4.2.27, 4.3.0 ≤ v < 4.3.14, 4.4.0 ≤ v < 4.4.6 | 4.2.27, 4.3.14, 4.4.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.