PT-2025-48281 · Mattermost · Mattermost

Daw10 · Published 2025-10-28 · Updated 2026-03-13 · CVE-2025-12421

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.12 Mattermost versions 10.11.x through 10.11.4 Mattermost versions 10.12.x through 10.12.1 Mattermost versions 11.0.x through 11.0.2

Description Mattermost fails to verify that the token used during the code exchange originates from the same authentication flow. This allows an authenticated user to perform account takeover by using a specially crafted email address when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The issue requires ExperimentalEnableAuthenticationTransfer to be enabled and RequireEmailVerification to be disabled.

Recommendations Mattermost versions 10.5.x through 10.5.12: Update to a newer, fixed version. Mattermost versions 10.11.x through 10.11.4: Update to a newer, fixed version. Mattermost versions 10.12.x through 10.12.1: Update to a newer, fixed version. Mattermost versions 11.0.x through 11.0.2: Update to a newer, fixed version.

Fix

Weakness Enumeration

CWE-303

Related Identifiers

BDU:2025-15264

CVE-2025-12421

GHSA-MP6X-97XJ-9X62

GO-2025-4170

SUSE-SU-2026:0037-1

Affected Products

Mattermost

References · 101

• https://bdu.fstec.ru/vul/2025-15264 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12421 · Security Note
• https://osv.dev/vulnerability/GO-2025-4170 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12421 · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/f361e7d75a7ab9df5a2106e1ceb919b94b55e41d · Note
• https://github.com/mattermost/mattermost/commit/acda1fb5dd46a2f46c76ae67012423c760525eaa · Note
• https://github.com/mattermost/mattermost/commit/feb598ed2b7ac3cb78a253b032ad7e4628b0de00 · Note
• https://github.com/mattermost/mattermost/commit/5072bbf689a46b3b97b2373f26149f5891396e6b · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note