CVE-2025-27157: 
NixOS vulnerability analysis and mitigation

Mastodon, a self-hosted federated microblogging platform, introduced a vulnerability in version 4.2.0 that persisted until versions 4.2.16 and 4.3.4. The vulnerability was identified on February 27, 2025, and involves missing rate limits on the /auth/setup endpoint (GitHub Advisory, NVD).

The vulnerability (CVE-2025-27157) stems from the absence of rate limiting controls on the /auth/setup endpoint, which was introduced in version 4.2.0. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) (GitHub Advisory, NVD).

The vulnerability allows attackers to craft requests that can send emails to arbitrary addresses, potentially leading to email flooding and resource consumption. This could affect the availability of the email service and potentially be used for spam or harassment campaigns (GitHub Advisory).

The vulnerability is easily exploitable as it requires no privileges or user interaction. An attacker can remotely exploit this vulnerability by sending crafted requests to the /auth/setup endpoint (GitHub Advisory).

The vulnerability has been patched in Mastodon versions 4.2.16 and 4.3.4. The fix implements rate limiting controls on the /auth/setup endpoint. Users are advised to upgrade to these patched versions to protect against this vulnerability (GitHub Advisory).