title: Mastodon Remote user impersonation and takeover
description: Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.
problem types: CWE-290: Authentication Bypass by Spoofing
affected:
{
vendor: mastodon
product: mastodon
versions:
version: < 3.5.17, status: affected
version: >= 4.0.0, < 4.0.13, status: affected
version: >= 4.1.0, < 4.1.13, status: affected
version: >= 4.2.0, < 4.2.5, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
]