CVE-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
Attackers can bypass email confirmation rate limits to spam users and overwhelm mail queues, requiring administrators to upgrade Mastodon.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54879?
CVE-2025-54879 is a medium-severity vulnerability in mastodon, published on 5 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.
Weakness: CWE-770
Which versions are affected by CVE-2025-54879?
1 open source package ship an affected version, including mastodon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mastodon Bitnami | From 3.1.5 | 4.2.24, 4.3.11, 4.4.3 |
Products include Joinmastodon Mastodon.
How do I fix CVE-2025-54879?
Upgrade mastodon to a fixed version for your release line: 4.2.24, 4.3.11 or 4.4.3.
Is CVE-2025-54879 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54879 exists.
Other vulnerabilities in mastodon
- CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
- CVE-2022-24307 Missing authorization in n/a
- CVE-2018-21018 Auth bypass in n/a
- CVE-2024-23832 Mastodon Remote user impersonation and takeover
Sources
Also known as BIT-mastodon-2025-54879, GHSA-84ch-6436-c7mg.