Mastodon versions prior to 4.5.8, 4.4.15, and 4.3.21 allow attackers to trigger a server‑side redirect through the /web/* route by including a URL-encoded slash (%2F). This redirect occurs without authentication and directs users to an arbitrary external domain, creating opportunities for phishing attacks or OAuth credential theft. The underlying flaw is improper path normalization, classified as CWE‑601, and can be exploited simply by requesting a crafted GET URL.

The vulnerability affects Mastodon servers running the Mastodon application. Users of any Mastodon instance that has not updated beyond versions 4.5.8, 4.4.15, or 4.3.21 are at risk.

The CVSS base score of 4.3 indicates a moderate impact if exploited. No EPSS data is available, so the likelihood of exploitation cannot be quantified from the CVE record. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only that an attacker can send victims a malicious URL that includes an encoded slash, which is trivial to generate and distribute. Because authentication is not required, every user of a vulnerable instance is a potential target.