UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62174

Changing a user's password via CLI does not revoke sessions & access tokens

Severity
Low 3.5
Published
13 Oct 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.2.27, 4.3.14, 4.4.6
Also known as
GHSA-f3q3-rmf7-9655
Sources
NVD, Project advisories (GitHub)

Description

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised…

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • Every version before 4.2.27
  • From 4.3.0 before 4.3.14
  • From 4.4.0 before 4.4.6
MastodonServers and applications · github:mastodon/mastodon
  • Every version before 4.2.27

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62174
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62174
  • GitHub Advisory Database https://github.com/advisories/GHSA-f3q3-rmf7-9655
  • github.com https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q3-rmf7-9655