GHSA-8cgx-9ccj-3gwr
Mattermost fails to clear Google OAuth credentials
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.7.0-rc1, < 10.7.1 | 10.7.1 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.0.0-rc1, < 10.5.4 | 10.5.4 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.0.0-rc1, < 9.11.13 | 9.11.13 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250414095146-04676582cdd2 | 8.0.0-20250414095146-04676582cdd2 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.6.0-rc1, < 10.6.3 | 10.6.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.
References
External links from the advisory. They lead to third-party sites.