ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33868

Mastodon is a free, open-source social network server based on ActivityPub.

Published Mar 27, 2026 · updated Jun 17, 2026 · joinmastodon mastodon

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes ( ) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 27, 2026 · NIST NVD

    Detected

    Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing atta

  2. Jun 17, 2026 · NIST NVD

    Updated

    Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing atta

Affected

  • cpe joinmastodon/mastodonversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33868

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33868

    Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the route due to improper handling of URL-encoded path segments. An attacker can cr

    nvd.nist.gov

References