CVE-2025-12421 Details
Description
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
A vulnerability allowing account takeover has been identified in Mattermost versions 11.0.x through 11.0.2, 10.12.x through 10.12.1, 10.11.x through 10.11.4, and 10.5.x through 10.5.12. The issue arises because these versions fail to properly verify that the token used during the code exchange process originates from the same authentication flow. This flaw enables an authenticated user to exploit the vulnerability by using a specially crafted email address when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability is only exploitable when the ExperimentalEnableAuthenticationTransfer feature is enabled (which is the default setting) and the RequireEmailVerification option is disabled (also the default setting).
Users can upgrade to Mattermost versions 11.2.0, 10.12.2, 10.11.5, or 10.5.13 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://mattermost.com/security-updates | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-303 | Incorrect Implementation of Authentication Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mattermost mattermost server | >= 10.5.0, < 10.5.13 >= 10.11.0, < 10.11.5 >= 10.12.0, < 10.12.2 >= 11.0.0, < 11.0.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Nov 27, 2025 | New CVE Received | [email protected] |