Mastodon 4.7.5 patches authentication bypass, DoS, and proxy header flaws

The Mastodon project released version 4.7.5 on November 3, a security-focused patch addressing four CVE-class vulnerabilities and multiple dependency advisories. The most severe flaw, tracked as GHSA-3xjw-gv43-3w62, allowed password authentication bypass for inactive accounts. Two additional issues fixed by Claire Gabriel (ClearlyClaire) include a denial-of-service vulnerability through JSON-LD compaction (GHSA-cf49-73r7-rxj6) and a reverse-proxy header handling bug where Forwarded took precedence over X-Forwarded-For (GHSA-qp4r-p842-mw5c), potentially enabling IP spoofing. The release also updates dependencies to resolve security advisories in addressable, loofah, rack, and rails-html-sanitizer.

Administrators running Mastodon instances behind reverse proxies must verify their configuration ignores user-supplied X-Forwarded-For headers if using the Forwarded header, and those using the project's bundled nginx.conf should update it. The release includes a minor behavioral change where invite use counts no longer decrement when invited users delete accounts. Upgrade paths are provided for both Docker and non-Docker deployments, with a noted workaround for charlock_holmes gem build failures on systems with recent GCC versions.

Security fixes and deployment considerations in Mastodon 4.7.5

• Authentication bypass (GHSA-3xjw-gv43-3w62): Inactive accounts could have passwords bypassed, permitting unauthorized access without valid credentials.
• JSON-LD DoS (GHSA-cf49-73r7-rxj6): Maliciously crafted JSON-LD compaction payloads could exhaust server resources, fixed via pull request #41482.
• Proxy header precedence (GHSA-qp4r-p842-mw5c): The Forwarded header incorrectly overrode X-Forwarded-For, breaking IP-based rate limiting and security decisions; administrators must drop client-supplied X-Forwarded-For when relying on Forwarded.
• Dependency updates: addressable, loofah, rack, and rails-html-sanitizer were upgraded to resolve their respective security advisories.
• Build compatibility: The charlock_holmes gem may fail compilation on GCC versions defaulting to C++20 or later; the workaround forces C++17 via BUNDLE_BUILD__CHARLOCK_HOLMES environment variable.

Why it matters

Fediverse operators running single-user or multi-thousand-user instances must prioritize this update due to the authentication bypass and trivially exploitable DoS vector. The proxy header fix affects a common nginx/Mastodon deployment pattern, making configuration review as critical as the code upgrade. For the broader open-source social networking ecosystem, the coordinated disclosure and rapid patch release by the core team demonstrates mature security stewardship that other ActivityPub implementations should emulate.