{"id":"CVE-2025-54879","summary":"Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails","details":"Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.","aliases":["BIT-mastodon-2025-54879","GHSA-84ch-6436-c7mg"],"modified":"2026-04-10T05:29:42.233204Z","published":"2025-08-05T23:39:59.130Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54879.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-770"]},"references":[{"type":"WEB","url":"https://github.com/mastodon/mastodon/releases/tag/v4.4.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54879.json"},{"type":"ADVISORY","url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-84ch-6436-c7mg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54879"},{"type":"FIX","url":"https://github.com/mastodon/mastodon/commit/e2592419d93fb41be03c2f3ff6a122fecb0e0952"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mastodon/mastodon","events":[{"introduced":"661f3f26b041dd6f1f0ea646e55616f7139bb957"},{"fixed":"ca1c58d5f69aae80fe22ac8ae982ae4ba2bf4165"}],"database_specific":{"versions":[{"introduced":"3.1.5"},{"fixed":"4.2.24"}]}},{"type":"GIT","repo":"https://github.com/mastodon/mastodon","events":[{"introduced":"ab36c152f9e5f9054798504354365dcaef4e5c43"},{"fixed":"42594f253e64c559ca2462abab0623dddc82f54c"}],"database_specific":{"versions":[{"introduced":"4.3.0"},{"fixed":"4.3.11"}]}},{"type":"GIT","repo":"https://github.com/mastodon/mastodon","events":[{"introduced":"69e14246b838443985a541e97327494b8d2fdffb"},{"fixed":"5478ef9b32be0c7ac8f86330760485a7531d218a"}],"database_specific":{"versions":[{"introduced":"4.4.0"},{"fixed":"4.4.3"}]}}],"versions":["v4.3.0","v4.3.1","v4.3.10","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v4.4.0","v4.4.1","v4.4.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54879.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/tootsuite/mastodon","events":[{"introduced":"661f3f26b041dd6f1f0ea646e55616f7139bb957"},{"fixed":"ca1c58d5f69aae80fe22ac8ae982ae4ba2bf4165"},{"introduced":"ab36c152f9e5f9054798504354365dcaef4e5c43"},{"fixed":"42594f253e64c559ca2462abab0623dddc82f54c"},{"introduced":"69e14246b838443985a541e97327494b8d2fdffb"},{"fixed":"5478ef9b32be0c7ac8f86330760485a7531d218a"}],"database_specific":{"versions":[{"introduced":"3.1.5"},{"fixed":"4.2.24"},{"introduced":"4.3.0"},{"fixed":"4.3.11"},{"introduced":"4.4.0"},{"fixed":"4.4.3"}]}}],"versions":["v4.3.0","v4.3.1","v4.3.10","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v4.4.0","v4.4.1","v4.4.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54879.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}