RE: https://mastodon.social/@MastodonEngineering/117553453842624500

So is https://github.com/mastodon/mastodon/security/advisories/GHSA-3xjw-gv43-3w62 a component in the recent wave of account takeovers then?

"A flaw in the log-in logic allowed a local user to switch to a different inactive local user mid-login, generating a sign-in token email for them without their password. They could then complete log-in as that different user [..]" - only if 2FA was enabled and the account was inactive for over three months.