CVE-2025-12419
published 2025-11-27CVE-2025-12419: Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID…
PriorityP266critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.32%
23.8th percentile
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 10.11.0 < 10.11.5 | 10.11.5 |
| github.com | mattermost_mattermost-server | >= 10.12.0 < 10.12.2 | 10.12.2 |
| github.com | mattermost_mattermost-server | >= 10.5.0 < 10.5.13 | 10.5.13 |
| github.com | mattermost_mattermost-server | >= 11.0.0 < 11.0.4 | 11.0.4 |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20251028000919-d3ed703dc833 | 8.0.0-20251028000919-d3ed703dc833 |
| mattermost | mattermost | 10.11.0 – 10.11.4 | — |
| mattermost | mattermost | 10.12.0 – 10.12.1 | — |
| mattermost | mattermost | 10.5.0 – 10.5.12 | — |
| mattermost | mattermost | 11.0.0 – 11.0.3 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.5 | 10.11.5 |
| mattermost | mattermost_server | >= 10.12.0 < 10.12.2 | 10.12.2 |
| mattermost | mattermost_server | >= 10.5.0 < 10.5.13 | 10.5.13 |
| mattermost | mattermost_server | >= 11.0.0 < 11.0.4 | 11.0.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server
osv·2025-12-15
CVE-2025-12419 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost-server from v10.5.0 before v10.5.13, from v10.11.0 before v10.11.5, from v10.12.0 before v10.12.2, from v11.0.0 before v11.0.4.
GHSA
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
ghsa·2025-11-27
CVE-2025-12419 [CRITICAL] CWE-287 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.
OSV
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
osv·2025-11-27
CVE-2025-12419 [CRITICAL] Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-27
Published