CVE-2026-33868: 
NixOS vulnerability analysis and mitigation

CVE-2026-33868 is an unauthenticated Open Redirect vulnerability (CWE-601) in Mastodon, the free, open-source ActivityPub-based social network server. The flaw exists in the /web/* route due to improper handling of URL-encoded path segments (%2F), allowing attackers to redirect users to arbitrary external domains. Affected versions include all releases prior to 4.3.21, 4.4.x before 4.4.15, and 4.5.x before 4.5.8. The vulnerability was published on March 27, 2026, with patches released the same day. The CVSS v3.1 base score is 6.1 (Medium) per NVD, though the official GitHub advisory rates it 4.3 (Moderate) (GitHub Advisory, Red Hat CVE).

The root cause is improper URL normalization in Mastodon's Rails-based /web/* route handler (CWE-601). URL-encoded forward slashes (%2F) bypass Rails path normalization and are interpreted as host-relative redirects, causing the application to issue an HTTP redirect to an attacker-controlled external domain. No authentication is required — any unauthenticated user visiting a crafted URL of the form /web/%2F<attacker-domain> will be silently redirected. A public proof-of-concept Python exploit script is available that automates target discovery via the instances.social API and mass-tests vulnerable endpoints (GitHub Advisory, PoC Exploit).

Successful exploitation enables unauthenticated attackers to redirect Mastodon users to arbitrary external domains, facilitating phishing attacks that abuse the trusted reputation of legitimate Mastodon instance URLs. Attackers can harvest credentials via fake login pages, intercept OAuth authorization codes when the redirect is chained with login flows, and exploit user trust in known instance domains. All visitors — including unauthenticated users — are affected, making the attack surface broad across any publicly accessible Mastodon instance (GitHub Advisory).

A functional public proof-of-concept exploit (Python script) is available on GitHub, capable of automated mass scanning of Mastodon instances via the instances.social API with multi-threaded vulnerability checking (PoC Exploit). The exploit was added to Feedly's tracking on March 27, 2026, and nuclei detection templates were subsequently added to ProjectDiscovery's nuclei-templates repository. The EPSS score is approximately 0.94%, indicating a relatively low but non-negligible probability of exploitation in the wild. No specific threat actor attribution or CISA KEV catalog listing has been identified at this time (Red Hat CVE).

1. Reconnaissance: Use the instances.social API or tools like Shodan to enumerate publicly accessible Mastodon instances running versions prior to 4.3.21, 4.4.15, or 4.5.8.
2. Craft malicious URL: Construct a redirect URL targeting the vulnerable /web/* route using a URL-encoded slash, e.g., https://<mastodon-instance>/web/%2F<attacker-domain>/fake-login.
3. Distribute the link: Send the crafted URL to target users via email, social media, or direct messages — the URL appears to originate from a trusted Mastodon instance domain.
4. Trigger redirect: When a victim clicks the link, the Mastodon server processes the %2F-encoded path segment, bypasses Rails path normalization, and issues an HTTP redirect to the attacker-controlled domain.
5. Harvest credentials or OAuth tokens: The victim lands on a phishing page mimicking the Mastodon login interface; submitted credentials or OAuth authorization codes are captured by the attacker.
6. Automate at scale: Use the public PoC script (python3 CVE-2026-33868.py 20 10 -o results.txt) to scan multiple instances concurrently and identify vulnerable targets for mass phishing campaigns (PoC Exploit, GitHub Advisory).

• Network: HTTP GET requests to /web/%2F<external-domain> or similar URL-encoded path patterns on Mastodon instances; outbound HTTP 302 redirect responses pointing to non-instance external domains from the /web/ route.
• Logs: Web server access logs showing requests matching the pattern GET /web/%2F followed by an external hostname; unusual redirect chains in application logs originating from the /web/* route handler.
• User Reports: Users reporting unexpected redirects to external sites after clicking links that appeared to originate from a trusted Mastodon instance URL.

Mastodon has released patched versions addressing this vulnerability: 4.5.8, 4.4.15, and 4.3.21. Administrators should upgrade to the appropriate patched version for their release branch as the primary remediation. As a supplementary measure, implement URL validation and normalization controls to reject or sanitize URL-encoded path segments (e.g., %2F) in redirect handling logic within the /web/* route. No official configuration-based workaround has been published; upgrading is the recommended and only fully effective fix (GitHub Advisory).

The vulnerability was reported by security researcher theamanrawat and the advisory was published by Mastodon maintainer renchap on March 25, 2026 (GitHub Advisory). Community discussion was observed on Bluesky and Mastodon-adjacent social platforms shortly after disclosure. ProjectDiscovery added nuclei detection templates for this CVE to their nuclei-templates repository, reflecting active interest from the security research community in automated detection.