CVE-2024-25619

Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a `dependent: delete_all` configuration, which means the `after_commit` callback setup on `AccessTokenExtension` didn't actually fire, since `delete_all` doesn't trigger ActiveRecord callbacks. To mitigate, we need to add a `before_destroy` callback to `ApplicationExtension` which announces to streaming that all the Application's Access Tokens are being "killed". Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability.

• CWE-613
• CWE-672
• CWE-613
• CWE-672

• https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3xVendor Advisory
• https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3xVendor Advisory

Published

Feb 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25613Authenticated command injection vulnerabilities exist in the…7.2
• CVE-2024-25614There is an arbitrary file deletion vulnerability in the CLI…9.1
• CVE-2024-25615 An unauthenticated Denial-of-Service (DoS) vulnerability ex…5.3
• CVE-2024-25616Aruba has identified certain configurations of ArubaOS that …3.7
• CVE-2024-25617Squid is an open source caching proxy for the Web supporting…7.5
• CVE-2024-25618Mastodon is a free, open-source social network server based …7.4
• CVE-2024-2562A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-25620Helm is a tool for managing Charts. Charts are packages of p…6.4
• CVE-2024-25621containerd is an open-source container runtime. Versions 0.1…7.8
• CVE-2024-25622h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …4.3
• CVE-2024-25623Mastodon is a free, open-source social network server based …7.7
• CVE-2024-25624Iris is a web collaborative platform aiming to help incident…6.8