https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T09:03:05.006963+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-mastodon-2025-27157 BIT-mastodon-2025-27157 — Mastodon's rate-limits are missing on `/auth/setup` 2026-10-16T09:03:05.010692+00:00

Affected: Bitnami: mastodon

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-219482 EUVD-2026-219482 2026-10-16T09:03:05.010738+00:00 EUVD-2026-219482 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27157 fkie_cve-2025-27157 2026-10-16T09:03:05.010753+00:00

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.