CVE-2025-62174: mastodon before 4.2.27 (exclusive), from 4.3.0 (inclusive), before 4.3.14 (exclusive), from 4.4.0 (inclusive), before…

Affected technology

mastodon · before 4.2.27 (exclusive)
joinmastodon

mastodon · from 4.3.0 (inclusive), before 4.3.14 (exclusive)
joinmastodon

mastodon · from 4.4.0 (inclusive), before 4.4.6 (exclusive)
joinmastodon

mastodon · >= 4.4.0-beta.1, < 4.4.6, >= 4.3.0-beta.1, < 4.3.14, < 4.2.27
mastodon

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An attacker with access to a previously compromised session or token can continue using the account after the password has been reset. Vendor/CNA’s CVSS 3.1 assessment (base score 3.5/10) rates confidentiality impact as low; integrity and availability impact as none.