https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T21:05:56.628437+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-mastodon-2026-33868 BIT-mastodon-2026-33868 — Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' 2026-10-06T21:05:56.703944+00:00

Affected: Bitnami: mastodon

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-278358 EUVD-2026-278358 2026-10-06T21:05:56.704002+00:00 EUVD-2026-278358 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33868 fkie_cve-2026-33868 2026-10-06T21:05:56.704019+00:00

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.