CVE-2023-36462

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

• CWE-20

• https://github.com/mastodon/mastodon/commit/610731b03dfcadd887078cb0399f4e514aa1931cPatch
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9Release Notes
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5Release Notes
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3Release Notes
• https://github.com/mastodon/mastodon/security/advisories/GHSA-55j9-c3mp-6fcqVendor Advisory
• https://github.com/mastodon/mastodon/commit/610731b03dfcadd887078cb0399f4e514aa1931cPatch
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9Release Notes
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5Release Notes
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3Release Notes
• https://github.com/mastodon/mastodon/security/advisories/GHSA-55j9-c3mp-6fcqVendor Advisory

Published

Jul 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-364571Panel is an open source Linux server operation and maintena…8.8
• CVE-2023-364581Panel is an open source Linux server operation and maintena…8.8
• CVE-2023-36459Mastodon is a free, open-source social network server based …6.1
• CVE-2023-3646On affected platforms running Arista EOS with mirroring to m…7.5
• CVE-2023-36460Mastodon is a free, open-source social network server based …9.9
• CVE-2023-36461Mastodon is a free, open-source social network server based …7.5
• CVE-2023-36463Meldekarten generator is an open source project to create a …6.1
• CVE-2023-36464pypdf is an open source, pure-python PDF library. In affecte…5.5
• CVE-2023-36465Decidim is a participatory democracy framework, written in R…7.1
• CVE-2023-36466Discourse is an open source discussion platform. When editin…4.3
• CVE-2023-36467AWS data.all is an open source development framework to help…8.8
• CVE-2023-36468XWiki Platform is a generic wiki platform offering runtime s…8.8