CVE-2025-27157: Mastodon Auth Bypass Vulnerability

CVE-2025-27157 Overview

CVE-2025-27157 affects Mastodon, a self-hosted federated microblogging platform. The vulnerability stems from missing rate limits on the /auth/setup endpoint in versions 4.2.0 through 4.2.15 and 4.3.0 through 4.3.3. An attacker can craft repeated requests to this endpoint to trigger emails sent to arbitrary addresses. This creates an email flooding primitive that abuses the Mastodon instance as an outbound mail relay. The issue is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. Mastodon versions 4.2.16 and 4.3.4 fix the issue by extending the existing throttle rule in rack_attack.rb to cover PUT and PATCH requests on /auth/setup.

Critical Impact
Attackers can abuse an unauthenticated endpoint to send emails to arbitrary recipients, enabling harassment campaigns, spam distribution, and mail server reputation damage.

Affected Products

Mastodon versions 4.2.0 through 4.2.15
Mastodon versions 4.3.0 through 4.3.3
Self-hosted federated Mastodon instances

Discovery Timeline

2025-02-27 - CVE-2025-27157 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27157

Vulnerability Analysis

Mastodon uses the rack-attack middleware to enforce rate limits across authentication endpoints. The configuration in config/initializers/rack_attack.rb defines a throttle named throttle_email_confirmations/ip that limits requests to 25 per 5 minutes per IP. Before the patch, this throttle covered only POST requests to /auth/confirmation and /api/v1/emails/confirmations. The /auth/setup endpoint, which accepts PUT and PATCH requests and triggers confirmation emails, was omitted from the throttle rule.

The unauthenticated attacker can repeatedly submit setup requests with attacker-chosen email addresses. Each request causes the Mastodon backend to enqueue an outbound email through the instance's configured Simple Mail Transfer Protocol (SMTP) provider. The absence of throttling allows sustained request volumes limited only by network and server capacity.

Root Cause

The root cause is an incomplete rate-limit ruleset in the rack-attack initializer. The throttleable_remote_ip guard evaluated only POST requests against specific paths, leaving PUT and PATCH verbs on /auth/setup unmetered. This is a configuration and design flaw rather than a memory or logic error.

Attack Vector

The attack is network-based, requires no authentication, and no user interaction. An attacker sends crafted PUT or PATCH requests to /auth/setup on a vulnerable Mastodon instance with target email addresses in the payload. The instance dispatches an email to each supplied address without applying per-IP throttling.

ruby

# Patch from config/initializers/rack_attack.rb
  throttle('throttle_email_confirmations/ip', limit: 25, period: 5.minutes) do |req|
-    req.throttleable_remote_ip if req.post? && (req.path_matches?('/auth/confirmation') || req.path == '/api/v1/emails/confirmations')
+    req.throttleable_remote_ip if (req.post? && (req.path_matches?('/auth/confirmation') || req.path == '/api/v1/emails/confirmations')) || ((req.put? || req.patch?) && req.path_matches?('/auth/setup'))
  end

The patch extends the throttle predicate to include PUT and PATCH verbs on /auth/setup, applying the existing 25-requests-per-5-minutes limit. Source: GitHub Commit 06f879c.

Detection Methods for CVE-2025-27157

Indicators of Compromise

High-volume PUT or PATCH requests to /auth/setup from a single IP or narrow IP range within short time windows.
Outbound SMTP queue growth without corresponding legitimate signup activity.
Abuse complaints or bounce notifications referencing the Mastodon instance's sending domain.
Recipient domains showing no prior interaction history with the Mastodon instance.

Detection Strategies

Parse Mastodon and reverse-proxy access logs for repeated PUT/PATCH calls to /auth/setup and alert on rates exceeding baseline signup activity.
Correlate web-tier request counts with mailer queue depth in Sidekiq to identify email amplification patterns.
Monitor SMTP relay logs for bursts of confirmation emails sent to previously unseen recipient domains.

Monitoring Recommendations

Enable rack-attack logging and forward events to a centralized log store for retention and analysis.
Track per-IP request rates on all /auth/* endpoints and generate alerts when thresholds exceed established baselines.
Instrument SMTP delivery metrics including bounce rate, complaint rate, and unique-recipient count per hour.

How to Mitigate CVE-2025-27157

Immediate Actions Required

Upgrade to Mastodon 4.2.16 or 4.3.4 depending on the deployed major version.
Review recent SMTP logs for evidence of abuse and rotate the instance's outbound mail credentials if abuse is observed.
Apply upstream rate limits at the reverse proxy or web application firewall covering PUT and PATCH requests to /auth/setup.

Patch Information

Mastodon released fixes in versions 4.2.16 and 4.3.4. The fix is contained in commit 06f879ce9bea195344ac9f71e6799eea500628ec, which updates config/initializers/rack_attack.rb to include /auth/setup under the throttle_email_confirmations/ip rule. See the GitHub Security Advisory GHSA-v39f-c9jj-8w7h for the vendor's advisory.

Workarounds

Add an NGINX or HAProxy limit_req rule restricting PUT and PATCH requests to /auth/setup to a conservative per-IP rate.
Deploy a custom rack-attack throttle mirroring the upstream patch if upgrading immediately is not feasible.
Configure SMTP provider-level sending quotas to cap outbound email volume from the Mastodon instance.

bash

# NGINX example: rate-limit /auth/setup PUT/PATCH requests per IP
limit_req_zone $binary_remote_addr zone=mastodon_setup:10m rate=5r/m;

location = /auth/setup {
    limit_except GET POST {
        limit_req zone=mastodon_setup burst=5 nodelay;
    }
    proxy_pass http://mastodon_backend;
}