CVE-2025-12419
📋 TL;DR
This vulnerability allows authenticated attackers with team creation privileges to take over user accounts in Mattermost by manipulating OAuth state tokens during OpenID Connect authentication. It affects Mattermost instances with OAuth/OpenID Connect enabled and email verification disabled. Attackers need control over two SSO users where one has never logged into Mattermost.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of any user, potentially leading to data theft, privilege escalation, and lateral movement within the organization.
Likely Case
Targeted account compromise of specific users, potentially enabling access to sensitive communications and data.
If Mitigated
Limited impact if email verification is enabled or OAuth/OpenID Connect is disabled.
🎯 Exploit Status
Exploitation requires specific configuration conditions and authenticated access with team creation privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.12.2, 10.11.5, 10.5.13, 11.0.4
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Download and install the patched version from Mattermost releases. 3. Restart the Mattermost service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Enable Email Verification
allEnable email verification for new accounts to prevent exploitation.
Set 'Enable Email Notifications' and 'Require Email Verification' to true in System Console > Notifications
Disable OAuth/OpenID Connect
allTemporarily disable OAuth/OpenID Connect authentication if not required.
Disable OAuth 2.0 and OpenID Connect in System Console > Authentication
🧯 If You Can't Patch
- Enable email verification for all user accounts immediately.
- Restrict team creation privileges to only essential administrators.
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run 'mattermost version' command. Verify if using affected versions and OAuth/OpenID Connect is enabled with email verification disabled.Check Version:
mattermost versionVerify Fix Applied:
Confirm version is updated to patched versions (10.12.2, 10.11.5, 10.5.13, or 11.0.4) and test OAuth authentication flow.📡 Detection & Monitoring
Log Indicators:
- Unusual OAuth authentication patterns
- Multiple failed OAuth state validations
- Account takeover attempts from same IP
Network Indicators:
- Abnormal OAuth callback requests
- Suspicious authentication flow manipulations
SIEM Query:
source="mattermost" AND ("OAuth state validation failed" OR "authentication manipulation")