Mastodon CVE-2026-33868

While the CVSS score of 4.3 is moderate, the attack vector (Network), low complexity, and lack of authentication requirements indicate broad attack surface. The UI interaction requirement (CVSS:UI:R) reflects that users must click a malicious link, reducing likelihood of mass exploitation but not eliminating it-targeted phishing campaigns remain highly viable. The impact is limited to integrity (redirection to external site), with no confidentiality or availability impact directly from the vulnerability itself, though downstream OAuth token theft represents a significant secondary risk. EPSS exploitation probability data was not provided, but the simplicity of crafting URL-encoded payloads and the high user-interaction dependency suggest moderate real-world risk. The vulnerability is not confirmed as actively exploited (KEV status not indicated), and no public proof-of-concept has been identified, further supporting lower urgency than the CVSS alone might suggest. However, the phishing and credential theft vectors warrant prioritization for any organization running public-facing Mastodon instances.

An attacker crafts a malicious URL containing URL-encoded slashes in the /web/* path that, when clicked by a Mastodon user, redirects them to a phishing site mimicking the real Mastodon login page. The victim, believing they are on the legitimate domain, enters their credentials or grants OAuth permissions, which are then captured by the attacker. This attack requires user interaction (clicking the link) but is trivial to execute and highly effective in targeted campaigns against specific Mastodon instance communities.