Mastodon 4.7.1 and 4.7.5 fix password authentication bypasses (2FA with LDAP, PAM or SSO, and inactive accounts)

What this means for you

Some Mastodon servers let people sign in with a company or school login. A bug let someone skip the second login step on those servers. Another bug, fixed in November, let someone get past the password check on accounts that had not been used for a long time. Both are fixed in updates. If your server has updated, you are safe.

The details

• 4.7.1, September 1, 2026 (security):
  • "Fix password authentication bypass in 2FA auth for LDAP/PAM/SSO accounts" (GHSA-vx32-x96w-qq65). Also in 4.6.7, 4.5.17 and 4.4.24, all dated September 1, 2026.
  • "Fix disabled staff accounts still having access to admin API" (GHSA-62j4-hvj7-px3f).
  • "Fix Denial of Service when processing pathological JSON-LD activities" (GHSA-vgm8-frgh-rh2v).
• 4.7.4, October 29, 2026: adds a security challenge e-mail for users who try to log in after a long period of inactivity.
• 4.7.5, November 3, 2026 (security): "Fix password authentication bypass for inactive accounts" (GHSA-3xjw-gv43-3w62), plus a JSON-LD compaction DoS fix and a fix for the Forwarded header taking precedence over X-Forwarded-For. The 4.6.11, 4.5.21 and 4.4.28 releases of the same day carry the last two fixes but not the inactive-account one.
• Reverse proxies: if your proxy uses Forwarded instead of X-Forwarded-For, make sure it ignores user-provided X-Forwarded-For headers; servers using the provided nginx.conf should consider updating it.
• The changelog lists no REST API or OAuth changes for clients in these releases. The advisories hold the technical details; they were not readable from our checker.

What to do next

• Business owners: Nothing, unless you run your own Mastodon server: then update it.
• Marketers and agencies: Nothing.
• Developers: If you run a server, upgrade to 4.7.5 and review your reverse-proxy headers. Client code needs no change.