Back to Database
Status published
Medium
CVE-2025-27157
Mastodon's rate-limits are missing on `/auth/setup`
Vulnerability Description
Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27157
Credits & Attribution
No credits recorded in the NVD database.
References
More from mastodon
View All →CVE-2025-67500
Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration
Low
3.7
CVE-2025-62605
Mastodon quotes control can be bypassed
Medium
4.3
CVE-2025-62176
Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels
Medium
4.3
CVE-2025-62175
Mastodon streaming API fails to disconnect disabled and suspended users
Medium
4.3
CVE-2025-62174
Mastodon allows continued access after password reset via CLI
Low
3.5
Affected Vendor
mastodon
View all reports →Affected Software
mastodon
Vulnerable Versions:
>= 4.2.0, < 4.2.16, >= 4.3.0, < 4.3.4
Timeline
Official Publish:
February 27th, 2025
Last Modified:
February 27th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L