3.5

CVE-2025-62174

Mastodon allows continued access after password reset via CLI

Mastodon is a free, open-source social network server based on ActivityPub.  In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password has been reset. This issue has been patched in versions 4.2.27, 4.3.14, and 4.4.6. No known workarounds exist.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Joinmastodon ≫ Mastodon Version < 4.2.27
Joinmastodon ≫ Mastodon Version >= 4.3.0 < 4.3.14
Joinmastodon ≫ Mastodon Version >= 4.4.0 < 4.4.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.19% 0.09
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 3.5 2.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q3-rmf7-9655
Vendor Advisory
https://github.com/mastodon/mastodon/commit/1631fb80e8029d2c5425a03a2297b93f7e225217
Patch