~ / search / GHSA-3x39-62h4-f8j6

GHSA-3x39-62h4-f8j6

Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-12419

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20251028000919-d3ed703dc833 8.0.0-20251028000919-d3ed703dc833
Go github.com/mattermost/mattermost-server >= 10.12.0, < 10.12.2 10.12.2
Go github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.5 10.11.5
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.13 10.5.13
Go github.com/mattermost/mattermost-server >= 11.0.0, < 11.0.4 11.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.

References

External links from the advisory. They lead to third-party sites.