CVE-2025-12421

Vulnerable versions of Mattermost Server do not verify whether the token used during OAuth code exchange (endpoint /users/login/sso/code-exchange) originates from the same authentication flow that generated it. An attacker, being a logged-in user, can submit a specially crafted email address while switching authentication methods, and then send a request to the mentioned endpoint with a token from outside the original flow. Exploiting the vulnerability requires that the ExperimentalEnableAuthenticationTransfer option be enabled in the server configuration (default: enabled) and that RequireEmailVerification be disabled (default: disabled).

An authenticated attacker can take over control of any user account (account takeover), leading to complete compromise of confidentiality, integrity, and availability of data accessible from the compromised account.

Update Mattermost Server to the patched versions indicated by the vendor (details: https://mattermost.com/security-updates). Until the patch is deployed, it is recommended to disable the ExperimentalEnableAuthenticationTransfer option in the server configuration or enable RequireEmailVerification, which eliminates the conditions necessary to exploit the vulnerability.

Mattermost Server in versions: 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12