Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mastodon | mastodon | >= 4.5.0, < 4.5.8, >= 4.4.0, < 4.4.15, < 4.3.21 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Mastodon - Open Redirect http/cves/2026/CVE-2026-33868.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.