BIT-mastodon-2026-33868
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/mastodon/BIT-mastodon-2026-33868.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-mastodon-2026-33868
- Aliases
-
- CVE-2026-33868
- GHSA-xqw8-4j56-5hj6
- Published
- 2026-03-31T08:45:35.531Z
- Modified
- 2026-04-02T13:41:00.358955866Z
- Summary
- Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
- Details
-
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the
/web/*route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (%2F) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue. - Database specific
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*" ] }- References
Affected packages
Bitnami / mastodon
Package
- Name
- mastodon
- Purl
- pkg:bitnami/mastodon
Severity
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator