PT-2025-48273 · Mattermost · Mattermost

Daw10 · Published 2025-11-27 · Updated 2025-11-28 · CVE-2025-12419

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.12.1 Mattermost versions 10.11.x through 10.11.4 Mattermost versions 11.0.x through 11.0.3

Description Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication. This allows an authenticated attacker with team creation privileges to take over a user account by manipulating authentication data during the OAuth completion flow. This requires email verification to be disabled and OAuth/OpenID Connect to be enabled. The attacker must control two users in the SSO system, with one of them never having logged into Mattermost. The issue enables privileged users to hijack accounts by manipulating authentication data.

Recommendations Update Mattermost versions prior to 10.12.2 Update Mattermost versions prior to 10.11.5 Update Mattermost versions prior to 11.0.4 Update Mattermost versions prior to 10.5.13

Fix

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2025-12419

Affected Products

Mattermost

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12419 · Security Note
• https://twitter.com/VulmonFeeds/status/1994090647767114101 · Twitter Post
• https://twitter.com/CVEnew/status/1994078776859209742 · Twitter Post
• https://twitter.com/ncsc_gov_ie/status/1994536845146034360 · Twitter Post
• https://mattermost.com/security-updates · Note
• https://twitter.com/ZeroPathLabs/status/1994081735936458959 · Twitter Post
• https://twitter.com/CveFindCom/status/1994084153797550157 · Twitter Post
• https://twitter.com/gothburz/status/1994179991035093010 · Twitter Post
• https://twitter.com/0dayPublishing/status/1994076272905834729 · Twitter Post
• https://twitter.com/CCBalert/status/1994389911001018531 · Twitter Post