CVE-2025-62174: Mastodon allows continued access after password reset via CLI
Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using bin/tootctl accounts modify --reset-password, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password has been reset. This issue has been patched in versions 4.2.27, 4.3.14, and 4.4.6. No known workarounds exist.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62174?
The severity of CVE-2025-62174 is classified as medium risk due to potential exposure of user accounts and sessions.
How do I fix CVE-2025-62174?
To fix CVE-2025-62174, upgrade to Mastodon versions 4.4.6, 4.3.14, or 4.2.27 or later.
What types of accounts are affected by CVE-2025-62174?
CVE-2025-62174 affects user accounts whose passwords are reset by an administrator via the command-line interface.
Can CVE-2025-62174 allow unauthorized access to user data?
Yes, CVE-2025-62174 could potentially allow unauthorized access to active user sessions after a password reset.
What are the implications of CVE-2025-62174 for Mastodon administrators?
Administrators need to be cautious when resetting passwords as CVE-2025-62174 can lead to session hijacking risks.