CVE-2025-12421
Description
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
How to fix
- mattermost mattermost_server10.5.13, 10.11.5, 10.12.2, 11.0.3 or later
- github.com/mattermost/mattermost/server/v88.0.0-20251022210333-acda1fb5dd46 or later
- github.com/mattermost/mattermost-server11.0.3, 10.12.2, 10.11.5, 10.5.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mattermost mattermost_server | 10.5.0 ≤ v < 10.5.13, 10.11.0 ≤ v < 10.11.5, 10.12.0 ≤ v < 10.12.2, 11.0.0 ≤ v < 11.0.3 | 10.5.13, 10.11.5, 10.12.2, 11.0.3 |
| github.com/mattermost/mattermost/server/v8Go | v < 8.0.0-20251022210333-acda1fb5dd46 | 8.0.0-20251022210333-acda1fb5dd46 |
| github.com/mattermost/mattermost-serverGo | 11.0.0 ≤ v < 11.0.3, 10.12.0 ≤ v < 10.12.2, 10.11.0 ≤ v < 10.11.5, 10.5.0 ≤ v < 10.5.13, No range specified | 11.0.3, 10.12.2, 10.11.5, 10.5.13 |
| github.com/mattermost/mattermost-server/v5Go | No range specified | — |
| github.com/mattermost/mattermost-server/v6Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.