CVE-2025-62176: Mastodon Auth Bypass Vulnerability

CVE-2025-62176 Overview

Mastodon is an open-source, federated social network server built on the ActivityPub protocol. CVE-2025-62176 affects the Mastodon streaming server, which fails to enforce OAuth scope restrictions on public timeline subscriptions. Clients presenting any valid authentication token can subscribe to public channels and receive public timeline events, even when their token lacks the read:statuses scope. The issue falls under [CWE-280] (Improper Handling of Insufficient Permissions or Privileges). Impact is limited to newly published public posts, but limited-federation deployments may see unexpected access to those posts by under-scoped clients.

Critical Impact

OAuth clients without the read:statuses scope can subscribe to public timeline streaming channels and receive public posts in real time.

Affected Products

• Mastodon versions prior to 4.2.27
• Mastodon versions 4.3.0 through 4.3.13
• Mastodon versions 4.4.0 through 4.4.5

Discovery Timeline

• 2025-10-13 - CVE-2025-62176 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2025-62176

Vulnerability Analysis

The Mastodon streaming server validates OAuth bearer tokens for authenticity but does not verify the token's granted scopes before streaming public timeline events. When a client connects to channels such as public, public:local, public:remote, hashtag, or their :media variants, the server treats the token as sufficient as long as it is valid.

This bypasses the intended scope model, where read access to statuses should require the read:statuses scope. An application granted a narrower scope (for example, write-only or notification-only) still receives public posts streamed over WebSocket or Server-Sent Events in real time.

The exposure is bounded. The flaw does not retroactively leak historical posts and does not expose non-public (follower-only or direct) content. The practical risk is highest on limited-federation instances where operators expect public timelines to be gated by scope-aware clients.

Root Cause

The streaming server's channel authorization logic enumerated public channels in a PUBLIC_CHANNELS array and short-circuited the scope check for any entry in that list. Scope enforcement was effectively skipped for subscriptions targeting those channels.

Attack Vector

Exploitation requires network access to the streaming endpoint and possession of a valid OAuth token for the target instance. The attacker connects to a public streaming channel with a token lacking read:statuses and receives new public posts as they are published.

   }
 };
 
-const PUBLIC_CHANNELS = [
-  'public',
-  'public:media',
-  'public:local',
-  'public:local:media',
-  'public:remote',
-  'public:remote:media',
-  'hashtag',
-  'hashtag:local',
-];
-
 // Used for priming the counters/gauges for the various metrics that are
 // per-channel
 const CHANNEL_NAMES = [

Source: Mastodon patch commit 7e98fa9. The patch removes the hard-coded PUBLIC_CHANNELS list that bypassed scope validation, forcing all channel subscriptions through the standard scope-check path.

Detection Methods for CVE-2025-62176

Indicators of Compromise

• Streaming WebSocket or SSE connections to /api/v1/streaming/public, /public/local, /public/remote, or /hashtag endpoints using tokens that lack the read:statuses scope.
• OAuth applications registered with narrow scopes but generating sustained streaming traffic volume.
• Unexpected clients subscribing to federated public channels on limited-federation instances.

Detection Strategies

• Correlate OAuth access token scopes recorded at token issuance with the channels those tokens subscribe to in streaming server logs.
• Flag any streaming subscription to a public channel where the associated token's scope set does not include read or read:statuses.
• Review oauth_access_tokens table entries and cross-reference active streaming sessions.

Monitoring Recommendations

• Enable verbose streaming server access logging and ship logs to a centralized analytics pipeline.
• Alert on new OAuth applications requesting non-standard scope combinations followed by streaming connections.
• Track per-token streaming connection counts and durations to identify anomalous data collection patterns.

How to Mitigate CVE-2025-62176

Immediate Actions Required

• Upgrade Mastodon to version 4.4.6, 4.3.14, or 4.2.27 depending on the deployed major release line.
• Audit all issued OAuth tokens and revoke tokens belonging to untrusted or unknown third-party applications.
• Review federation allow-lists on limited-federation instances to confirm expected posting scope.

Patch Information

The fix was committed in mastodon/mastodon commit 7e98fa9b and released in Mastodon 4.4.6, 4.3.14, and 4.2.27. Full advisory details are available in the GitHub Security Advisory GHSA-7gwh-mw97-qjgp.

Workarounds

• No official workarounds exist per the vendor advisory; upgrading is the only supported remediation.
• As an interim risk reduction, operators can revoke OAuth tokens for applications that do not require read:statuses and tighten new application registration review.

# Upgrade example for a standard Mastodon deployment
git fetch --tags
git checkout v4.4.6   # or v4.3.14 / v4.2.27
bundle install
yarn install --production
RAILS_ENV=production bundle exec rails db:migrate
systemctl restart mastodon-streaming mastodon-web mastodon-sidekiq