Stealing passwords from infosec Mastodon - without bypassing CSP
Summary: PortSwigger researcher Gareth Heyes found an HTML injection flaw in the Glitch fork of Mastodon used by infosec.exchange that let him spoof a login form and capture credentials via Chrome autofill without bypassing CSP. Mastodon released versions 4.0.1, 3.5.5, and 3.4.10 to mitigate the issue, and the Glitch developer noted core Mastodon was not vulnerable because it does not allow title attributes.
What's compelling: Chrome autofilled the password with no user interaction, and an opacity:0 class already in the site's CSS hid the inputs from view, so a convincing spoofed toolbar could harvest credentials from any logged-in user. Heyes noted the attack could easily be wormable by collecting credentials and re-posting the vector for each user.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026