CVE-2026-33868

MEDIUM NUCLEI

Mastodon /web Encoded Slash - Open Redirect

Title source: manual
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-33868. PoCs published by O99099O. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a Python-based mass vulnerability scanner for CVE-2026-33868, which targets a path traversal/information disclosure vulnerability. The tool automates target discovery via the instances.social API and checks for vulnerable endpoints by sending crafted requests to detect redirects to pastebin.com.

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.

Exploits (1)

nomisec SCANNER 2 stars
by O99099O · poc
https://github.com/O99099O/By-Poloss..-..CVE-2026-33868

This repository contains a Python-based mass vulnerability scanner for CVE-2026-33868, which targets a path traversal/information disclosure vulnerability. The tool automates target discovery via the instances.social API and checks for vulnerable endpoints by sending crafted requests to detect redirects to pastebin.com.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Web applications with vulnerable endpoints (specific software not explicitly mentioned)
No auth needed
Prerequisites: Access to instances.social API · Python 3.7+ · requests library
devstral-2 · analyzed Apr 08, 2026 Full analysis →

Nuclei Templates (1)

Mastodon - Open Redirect
MEDIUMVERIFIEDby theamanrawat
Shodan: html:"mastodon-"

References (1)

Core 1
Core References

Scores

CVSS v3 4.3
EPSS 0.0173
EPSS Percentile 82.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (4)
joinmastodon/mastodon < 4.3.21
mastodon/mastodon < 4.3.21
mastodon/mastodon >= 4.4.0, < 4.4.15
mastodon/mastodon >= 4.5.0, < 4.5.8
Published Mar 27, 2026
Tracked Since Mar 29, 2026