CVE-2025-12419

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mattermost 10.12.x menor o igual que 10.12.1, 10.11.x menor o igual que 10.11.4, 10.5.x menor o igual que 10.5.12, 11.0.x menor o igual que 11.0.3 no validan correctamente los tokens de estado de OAuth durante la autenticación de OpenID Connect, lo que permite a un atacante autenticado con privilegios de creación de equipos tomar el control de una cuenta de usuario mediante la manipulación de datos de autenticación durante el flujo de finalización de OAuth. Esto requiere que la verificación de correo electrónico esté deshabilitada (predeterminado: deshabilitado), que OAuth/OpenID Connect esté habilitado, y que el atacante controle dos usuarios en el sistema SSO, uno de los cuales nunca haya iniciado sesión en Mattermost.

Information

Published : 2025-11-27 16:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-12419

Mitre link : CVE-2025-12419

CVE.ORG link : CVE-2025-12419

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-303

Incorrect Implementation of Authentication Algorithm

{"id": "CVE-2025-12419", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12419", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-02T04:55:59.011337Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.12.0", "versionType": "semver", "lessThanOrEqual": "10.12.1"}, {"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.4"}, {"status": "affected", "version": "10.5.0", "versionType": "semver", "lessThanOrEqual": "10.5.12"}, {"status": "affected", "version": "11.0.0", "versionType": "semver", "lessThanOrEqual": "11.0.3"}, {"status": "unaffected", "version": "11.1.0"}, {"status": "unaffected", "version": "10.12.2"}, {"status": "unaffected", "version": "10.11.5"}, {"status": "unaffected", "version": "10.5.13"}, {"status": "unaffected", "version": "11.0.4"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-27T16:15:46.957", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-303"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost."}, {"lang": "es", "value": "Las versiones de Mattermost 10.12.x menor o igual que 10.12.1, 10.11.x menor o igual que 10.11.4, 10.5.x menor o igual que 10.5.12, 11.0.x menor o igual que 11.0.3 no validan correctamente los tokens de estado de OAuth durante la autenticaci\u00f3n de OpenID Connect, lo que permite a un atacante autenticado con privilegios de creaci\u00f3n de equipos tomar el control de una cuenta de usuario mediante la manipulaci\u00f3n de datos de autenticaci\u00f3n durante el flujo de finalizaci\u00f3n de OAuth. Esto requiere que la verificaci\u00f3n de correo electr\u00f3nico est\u00e9 deshabilitada (predeterminado: deshabilitado), que OAuth/OpenID Connect est\u00e9 habilitado, y que el atacante controle dos usuarios en el sistema SSO, uno de los cuales nunca haya iniciado sesi\u00f3n en Mattermost."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91D99F7F-B4EE-447C-9B77-82DD64B1D83A", "versionEndExcluding": "10.5.13", "versionStartIncluding": "10.5.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8368192-621C-4043-827E-DB4F6946AD92", "versionEndExcluding": "10.11.5", "versionStartIncluding": "10.11.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED48D731-6490-4DD5-94D4-EE4555BB93ED", "versionEndExcluding": "10.12.2", "versionStartIncluding": "10.12.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "387D98AD-59D7-4783-B0D2-E5CF2F7343B0", "versionEndExcluding": "11.0.4", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}