Mastodon Streaming Server OAuth Scope Bypass Vulnerability

A vulnerability exists in the Mastodon streaming server in versions prior to 4.4.6, 4.3.14, and 4.2.27. The issue allows OAuth clients to subscribe to public timelines using any valid authentication token, even if the token does not include the necessary read:statuses scope. This could result in unauthorized access to new public posts on the timelines, particularly in limited-federation environments.

Impact

Exploitation of this vulnerability could lead to unauthorized access to public posts on limited-federation timelines.

Reproduction

To reproduce this vulnerability, use an OAuth client with a valid token that lacks the read:statuses scope. Subscribe to a public channel on the streaming server. The subscription will be accepted, and events for new public posts will be received, despite the absence of the required read scope.

Remediation

Users can update to Mastodon versions 4.4.6, 4.3.14, or 4.2.27 to address this vulnerability.