CVE-2025-12419 PUBLISHED

Account takeover on OAuth/OpenID-enabled servers

Assigner: Mattermost
Reserved: 28.10.2025 Published: 27.11.2025 Updated: 02.12.2025

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Product Status

Vendor Mattermost
Product Mattermost
Versions Default: unaffected
  • affected from 10.12.0 to 10.12.1 (incl.)
  • affected from 10.11.0 to 10.11.4 (incl.)
  • affected from 10.5.0 to 10.5.12 (incl.)
  • affected from 11.0.0 to 11.0.3 (incl.)
  • Version 11.1.0 is unaffected
  • Version 10.12.2 is unaffected
  • Version 10.11.5 is unaffected
  • Version 10.5.13 is unaffected
  • Version 11.0.4 is unaffected

Solutions

Update Mattermost to versions 11.1.0, 10.12.2, 10.11.5, 10.5.13, 11.0.4 or higher.

Credits

  • daw10 finder

References

Problem Types

  • CWE-303: Incorrect Implementation of Authentication Algorithm CWE