CVE-2026-33868: Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the /web/ route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (%2F) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33868?
CVE-2026-33868 is classified as a medium-severity vulnerability due to its potential for exploitation via open redirects.
How do I fix CVE-2026-33868?
To fix CVE-2026-33868, you should upgrade to Mastodon versions 4.5.8, 4.4.15, or 4.3.21 or later.
What types of systems are affected by CVE-2026-33868?
CVE-2026-33868 affects Mastodon versions prior to 4.5.8, 4.4.15, and 4.3.21.
What is an Open Redirect vulnerability in the context of CVE-2026-33868?
An Open Redirect vulnerability allows attackers to redirect users to malicious external sites by manipulating URL parameters.
Is authentication required to exploit CVE-2026-33868?
No, CVE-2026-33868 is exploitable without authentication, making it particularly concerning for users.