CVE-2026-59825— Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Possible ATT&CK Techniques 1AI
T1557 · Adversary-in-the-MiddleGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59825
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Source: CVE Program / CVE List V5
Vulnerability Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-59825
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59825
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59825 (5)
- 🔗 Release v4.5.12 · mastodon/mastodon · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-59825 (1)
Vendor Pages for CVE-2026-59825 (1)
- 🔗 Release v4.4.19 · mastodon/mastodon · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: mastodon
- CVE-2026-72916
Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Ad - CVE-2026-72915
Mastodon: Personally-identifying information disclosure due - CVE-2026-72914
Mastodon: Exhausting data by an unauthenticated request to t - CVE-2026-50129
Mastodon: Persistent anonymous DoS via unhandled NoMethodErr - CVE-2026-50128
Mastodon: Spoofing of attribution domains
Same vendor: mastodon
- CVE-2026-72916
Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Ad - CVE-2026-72915
Mastodon: Personally-identifying information disclosure due - CVE-2026-72914
Mastodon: Exhausting data by an unauthenticated request to t - CVE-2026-50129
Mastodon: Persistent anonymous DoS via unhandled NoMethodErr - CVE-2026-50128
Mastodon: Spoofing of attribution domains
Same weakness: CWE-295
- CVE-2026-17024
Vulnerabilities in IBM AIX and PowerVM VIOS - CVE-2026-53583
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Ba - CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permis - CVE-2026-73251
Mongoose Built-in TLS: CA-bundle certificate chain accepted - CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector
V. Comments for CVE-2026-59825
No comments yet