Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account

Mastodon disclosed a critical origin-validation vulnerability (CVE-2024-23832, severity 9.4) that can allow attackers to impersonate and take over any remote account; many pre-3.5.17 and pre-4.x patch versions are affected. The maintainers credited a security researcher, warned administrators to update instances, and withheld further technical details until a scheduled disclosure date to reduce the risk of easy exploitation.