CVE-2025-62174 Mastodon allows continued access after password reset via CLI
Attackers with existing sessions can retain account access after an admin resets the password via CLI, bypassing session revocation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-62174?
CVE-2025-62174 is a low-severity vulnerability in mastodon, published on 13 Oct 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password has been reset. This issue has been patched in versions 4.2.27, 4.3.14, and 4.4.6. No known workarounds exist.
Weakness: CWE-613
Which versions are affected by CVE-2025-62174?
1 open source package ship an affected version, including mastodon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mastodon Bitnami | All versions | 4.2.27, 4.3.14, 4.4.6 |
Products include Joinmastodon Mastodon.
How do I fix CVE-2025-62174?
Upgrade mastodon to a fixed version for your release line: 4.2.27, 4.3.14 or 4.4.6.
Is CVE-2025-62174 being exploited?
There is no known exploitation of CVE-2025-62174 in the wild and no public exploit code.
Other vulnerabilities in mastodon
- CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
- CVE-2022-24307 Missing authorization in n/a
- CVE-2018-21018 Auth bypass in n/a
- CVE-2024-23832 Mastodon Remote user impersonation and takeover
Sources
Also known as BIT-mastodon-2025-62174, GHSA-f3q3-rmf7-9655.