CVE-2026-59825

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.19 Mastodon versions 4.5.0 through 4.5.11

Description When LDAP authentication is configured with LDAP TLS NO VERIFY=true, the file app/models/concerns/user/ldap authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT PARAMS. This action disables SSL and TLS certificate verification globally for all requests handled by puma web processes, although sidekiq background jobs are not impacted.

Recommendations Update to version 4.4.19. Update to version 4.5.12. Avoid setting LDAP TLS NO VERIFY=true to prevent the global disabling of certificate verification.