CVE-2025-9084
published 2025-09-15CVE-2025-9084: Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.16%
5.7th percentile
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 10.5.0 < 10.5.10 | 10.5.10 |
| github.com | mattermost_mattermost-server | >= 10.5.0+incompatible < 10.5.10+incompatible | 10.5.10+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-202508080704-39bd251fe4f600 | 8.0.0-202508080704-39bd251fe4f600 |
| mattermost | mattermost | 10.5.0 – 10.5.9 | — |
| mattermost | mattermost_server | >= 10.5.0 < 10.5.10 | 10.5.10 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server
osv·2025-09-17
CVE-2025-9084 Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server
Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server
Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.0.0-202508080704-39bd251fe4f600.
GHSA
Mattermost Open Redirect vulnerability
ghsa·2025-09-15
CVE-2025-9084 [LOW] CWE-601 Mattermost Open Redirect vulnerability
Mattermost Open Redirect vulnerability
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs.
OSV
Mattermost Open Redirect vulnerability
osv·2025-09-15
CVE-2025-9084 [LOW] Mattermost Open Redirect vulnerability
Mattermost Open Redirect vulnerability
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-15
Published