The vulnerability arises when LDAP authentication is configured with LDAP_TLS_NO_VERIFY, causing the application to alter the OpenSSL default SSL context settings. This alteration removes certificate verification for all HTTPS requests made by the Puma web server, while sidekiq background jobs remain unaffected. Attackers can thus perform man‑in‑the‑middle attacks against outbound connections or spoof certificates without detection, compromising confidentiality and possibly enabling credential theft or injection of malicious content into user sessions. The weakness corresponds to improper certificate validation vulnerabilities (CWE-295).

Mastodon servers running any version of the open‑source social network from pre‑4.4.19 up to and including 4.5.12 are affected. The vulnerability occurs in the LDAP authentication concerns module, impacting the web process component. Versions 4.4.19 and 4.5.12 contain the fix and are not vulnerable.

The CVSS score of 7.4 indicates a high impact vulnerability. Although an EPSS score is not available, the vulnerability is exploited by modifying application settings or misconfiguring LDAP, which is a common operational scenario. The issue is not listed in the CISA KEV catalog, suggesting no active exploitation evidence yet. The likely attack vector involves an attacker gaining administrative privilege or manipulating LDAP configuration to set LDAP_TLS_NO_VERIFY, after which the application will tolerate invalid certificates and allow network attackers to intercept traffic. Given the severity and absence of mitigation by default, administrators should treat this as a high‑risk condition awaiting patch.