CVE-2026-33868 Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'

What is CVE-2026-33868?

CVE-2026-33868 is a medium-severity vulnerability in mastodon, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.

Weakness: CWE-601

Which versions are affected by CVE-2026-33868?

1 open source package ship an affected version, including mastodon. It affects 1 product.

Products include Joinmastodon Mastodon.

How do I fix CVE-2026-33868?

Upgrade mastodon to a fixed version for your release line: 4.3.21, 4.4.15 or 4.5.8.

Is CVE-2026-33868 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33868 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in mastodon

• CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments Critical 10.0
• CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon Critical 9.8
• CVE-2022-24307 Missing authorization in n/a Critical 9.8
• CVE-2018-21018 Auth bypass in n/a Critical 9.8
• CVE-2024-23832 Mastodon Remote user impersonation and takeover Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-mastodon-2026-33868, GHSA-xqw8-4j56-5hj6.