CVE-2026-33868
Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.
How to fix
- joinmastodon mastodon4.3.21, 4.4.15, 4.5.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joinmastodon mastodon | v < 4.3.21, 4.4.0 ≤ v < 4.4.15, 4.5.0 ≤ v < 4.5.8 | 4.3.21, 4.4.15, 4.5.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.