Pre-OTP Session Fixation & Unthrottled 2FA Brute-Force via Shared Pending User Session State (mastodon/mastodon)

0x01 // Advisory Summary

Mastodon authentication session handling permitted pre-OTP session fixation and unthrottled two-factor authentication (2FA) verification attempts across concurrent requests. Patched upstream in Mastodon v4.7.5 and v5.0.0-alpha.4.

0x02 // Affected Versions & Remediation

• Repository: mastodon/mastodon
• Affected Versions: >= 4.8.0-alpha.3, < 5.0.0-alpha.3 / 4.7.4
• Patched Versions: 5.0.0-alpha.4 / 4.7.5
• CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Reporter Credit: Serhii Shunko (@ccsimplyspolit)

0x03 // Canonical Verification Links

• Official GitHub Security Advisory: https://github.com/mastodon/mastodon/security/advisories/GHSA-3xjw-gv43-3w62
• Reporter Profile: https://github.com/ccsimplyspolit