CVE-2024-23832

—

CVSS 3.1

9.8 critical

EPSS

2%p83

Published

Feb 1, 2024 (Feb 1, 2024)

Modified

Jun 17, 2026

Description

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.

Vendors: joinmastodon
Products: mastodon
Weakness: CWE-290
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news4 stories

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832)

Help Net SecurityFeb 18, 20:22 UTC · Feb 18, 2024Vulnerability CVE-2024-23832 CVE-2023-36460

Week in review: 10 must-read cybersecurity books, AnyDesk hack, Patch Tuesday forecast

Help Net SecurityFeb 11, 00:00 UTC · Feb 11, 2024Vulnerability CVE-2024-23832 CVE-2024-21893 CVE-2024-23917

Mastodon fixed a flaw that can allow take over of any account

Security AffairsFeb 3, 15:40 UTC · Feb 3, 2024Exploit / PoC CVE-2024-23832 CVE-2023-36460

Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account

The Hacker NewsFeb 3, 06:51 UTC · Feb 3, 2024Vulnerability CVE-2024-23832 CVE-2023-36460