EUVD-2026-16783Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the /web/* route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (%2F) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.
AnalysisAI
Mastodon prior to versions 4.5.8, 4.4.15, and 4.3.21 contains an unauthenticated Open Redirect vulnerability in the /web/* route that allows remote attackers to redirect users to arbitrary external domains via specially URL-encoded path segments. An attacker can exploit this to conduct phishing attacks or steal OAuth credentials by crafting malicious links that bypass Rails path normalization through URL-encoded slashes (%2F). No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
The vulnerability exists in Mastodon's web route handler where user-supplied URL-encoded path segments are not properly normalized before being used in redirect operations. Specifically, URL-encoded forward slashes (%2F) bypass Rails' standard path normalization logic, allowing an attacker to inject host-relative redirects that are interpreted as external URLs. This is a classic Open Redirect flaw (CWE-601) stemming from insufficient input validation on redirect targets. The issue affects Mastodon's ActivityPub-based social network implementation across multiple stable release lines (4.3.x, 4.4.x, and 4.5.x), with the vulnerable code path exposed through unauthenticated web routes, meaning any user without credentials can trigger the malicious redirect.
RemediationAI
Upgrade Mastodon immediately to version 4.5.8, 4.4.15, or 4.3.21 depending on your current release line. These patched versions implement proper URL normalization and input validation for redirect targets in the /web/* route. Administrators should prioritize upgrades for publicly accessible Mastodon instances given the phishing attack surface. For details on the fix and upgrade procedures, consult the official GitHub security advisory at https://github.com/mastodon/mastodon/security/advisories/GHSA-xqw8-4j56-5hj6. No workaround is documented; patching is the definitive remediation.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today