CVE-2026-59825
Received Received - Intake

SSL Certificate Verification Bypass in Mastodon

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-59825
EUVD
EUVD-2026-60953

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mastodon mastodon From 4.5.0 (inc) to 4.5.12 (exc)
mastodon mastodon 4.4.19
mastodon mastodon to 4.5.12 (exc)
mastodon mastodon 4.5.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mastodon versions before 4.4.19 and from 4.5.0 to 4.5.12 have a vulnerability where enabling LDAP authentication with LDAP_TLS_NO_VERIFY=true causes the application to disable SSL and TLS certificate verification globally for web requests. This mutation affects OpenSSL::SSL::SSLContext::DEFAULT_PARAMS and impacts all Puma web processes, while Sidekiq background jobs remain unaffected.

Impact Analysis

This vulnerability allows attackers to intercept or manipulate data transmitted between clients and the Mastodon server by bypassing SSL/TLS certificate checks. It could lead to man-in-the-middle attacks, unauthorized access to sensitive information, or impersonation of legitimate users.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA, which mandate strong encryption and secure data transmission. Disabling SSL/TLS verification undermines data integrity and confidentiality, exposing organizations to legal and regulatory penalties.

Mitigation Strategies

Upgrade Mastodon to version 4.4.19 or 4.5.12 or later to fix the vulnerability. Check if LDAP_TLS_NO_VERIFY=true is set in your configuration and remove or secure it to prevent SSL/TLS certificate verification bypass.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart