Mastodon allows new user registration to be limited by email domain name but performs insufficient validation of the email addresses submitted. The system does not prevent characters that can be interpreted differently by certain mail servers, allowing an attacker to register an account with a deceptively valid address. While the vulnerability does not provide immediate remote code execution, it can enable an attacker to create accounts that bypass domain restrictions, potentially facilitating social engineering, spam, or other malicious activities on the platform.

The affected product is Mastodon distributed by the mastodon vendor. Versions prior to 4.5.9, 4.4.16, and 4.3.22 are vulnerable. Users running any earlier release of the software are impacted until they update to one of the patched versions.

The CVSS score of 8.2 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently considered unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote user initiating a registration request. An attacker could exploit the lack of email validation to create a user account that appears to belong to a whitelisted domain, thereby bypassing administrative controls.