Description
Mastodon 社交平台在 /web/ 路由* 对 URL 编码路径处理存在校验缺陷，攻击者可构造包含 URL编码斜杠（%2F）的恶意链接，绕过路径规范化校验，触发未授权开放重定向，将用户从可信 Mastodon 实例跳转至钓鱼、恶意站点。
Mastodon社交平台存在重定向漏洞(CVE-2026-33868)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2026-33868
https://github.com/mastodon/mastodon/security/advisories/GHSA-xqw8-4j56-5hj6
https://pentest-tools.com/vulnerabilities-exploits/mastodon-open-redirect_29068
https://www.sentinelone.com/vulnerability-database/cve-2026-33868/
https://cve.scap.org.cn/vulnerability/VHN-363541
https://47.114.112.33/DVB-2026-11023.html
https://webtechsurvey.com/cve/CVE-2026-33868
https://www.tenable.com/cve/CVE-2026-33868/cpes