CVSS 3.1 Score 3.1 of 10 (low)


Published Feb 14, 2024
Updated: Feb 15, 2024
CWE ID 672
CWE ID 613


CVE-2024-25619 is a vulnerability that affects Mastodon, a free and open-source social network server based on ActivityPub. The issue arises when an OAuth Application is destroyed, as the streaming server is not informed that the Access Tokens associated with the application have also been destroyed. This poses a security risk as it allows an application to continue listening to streaming even after it has been destroyed. To mitigate this vulnerability, a before_destroy callback needs to be added to ApplicationExtension in order to notify streaming that all the Application's Access Tokens are being terminated. The impact of this vulnerability is considered negligible, as the affected application needs to be owned by the user. However, it has been addressed in subsequent versions of Mastodon.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-25619 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options