CVE-2025-12419 Details
Description
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.
A vulnerability exists in Mattermost versions 10.12.x through 10.12.1, 10.11.x through 10.11.4, 10.5.x through 10.5.12, and 11.0.x through 11.0.3. These versions fail to properly validate OAuth state tokens during OpenID Connect authentication. This flaw allows an authenticated attacker with team creation privileges to take over a user account by manipulating authentication data during the OAuth completion process. The attack requires email verification to be disabled (which is the default), and for the attacker to control two users in the SSO system, with one having never logged into Mattermost.
Users can upgrade to Mattermost versions 11.2.011.1.111.0.610.12.410.11.8, 11.1.010.11.510.5.13, or 11.1.010.11.5 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://mattermost.com/security-updates | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-303 | Incorrect Implementation of Authentication Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mattermost mattermost server | >= 10.5.0, < 10.5.13 >= 10.11.0, < 10.11.5 >= 10.12.0, < 10.12.2 >= 11.0.0, < 11.0.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Nov 27, 2025 | CVE Modified | [email protected] |
| Nov 27, 2025 | New CVE Received | [email protected] |