Open-source package vulnerability · Go

CVE-2025-12419: Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication

criticalCVSS 3.1 9.9GHSA-3x39-62h4-f8j6

Published Nov 27, 2025 · Updated Dec 17, 2025

Affected packages

github.com/mattermost/mattermost/server/v8

Ecosystem: Go
Affected: < 8.0.0-20251028000919-d3ed703dc833
Fixed in: 8.0.0-20251028000919-d3ed703dc833
Check: go list -m github.com/mattermost/mattermost/server/v8

github.com/mattermost/mattermost-server

Ecosystem: Go
Affected: >= 10.12.0, < 10.12.2
Fixed in: 10.12.2
Check: go list -m github.com/mattermost/mattermost-server

github.com/mattermost/mattermost-server

Ecosystem: Go
Affected: >= 10.11.0, < 10.11.5
Fixed in: 10.11.5
Check: go list -m github.com/mattermost/mattermost-server

github.com/mattermost/mattermost-server

Ecosystem: Go
Affected: >= 10.5.0, < 10.5.13
Fixed in: 10.5.13
Check: go list -m github.com/mattermost/mattermost-server

github.com/mattermost/mattermost-server

Ecosystem: Go
Affected: >= 11.0.0, < 11.0.4
Fixed in: 11.0.4
Check: go list -m github.com/mattermost/mattermost-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries