Mastodon CVE-2025-62174

Two concrete prerequisites must both hold: (1) the attacker must ALREADY possess a valid compromised session cookie or OAuth access token for the target account, and (2) an administrator must reset that account's password specifically via the command-line path bin/tootctl accounts modify --reset-password on Mastodon versions before 4.4.6, 4.3.14, or 4.2.27. The flaw is that this CLI reset fails to invalidate the pre-existing session/token. Limiting factors: it provides no initial access by itself (prior compromise is mandatory), it is scoped to a single victim account, and no known workaround exists other than upgrading - so defenders relying on a tootctl password reset as an incident-response eviction step were not actually revoking attacker access.

This is a low-severity session-management defect (CWE-613, Insufficient Session Expiration), and the multiple signals agree it is NOT a high priority. The provided CVSS base score is 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N), EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit is identified at time of analysis - so all exploitation signals are consistently low with none conflicting. The defining limitation is that this is purely a remediation-failure flaw: it grants NO new access on its own. An attacker must ALREADY possess a compromised session or access token, and the flaw only means that the specific CLI remediation path (bin/tootctl accounts modify --reset-password) fails to evict that pre-existing foothold. Note a minor tension in the input CVSS: it lists C:L/I:N while the real-world effect is continued full account control, which also implies an integrity impact (posting/changing settings as the victim) - see assessed vector below. There is no SSVC decision data provided. Bottom line: a genuine hardening bug that undermines incident response, worth patching on a normal cycle, but not an emergency - real risk is contingent on a prior compromise having already occurred.

An attacker who previously stole a user's session cookie or OAuth access token (e.g., via phishing or a prior compromise) retains it. A Mastodon administrator, believing they are locking the attacker out, resets the account password from the command line with bin/tootctl accounts modify --reset-password; because active sessions and tokens are not revoked, the attacker's stale token keeps working and they continue controlling the account. No public exploit code has been identified for this issue.