CVE-2025-12421

CRITICAL EPSS 22.7%
Published Nov 27, 20257mo ago · Modified Jun 17, 20262w ago
9.9 CVSS 3.1
Critical
Find Similar
Published Nov 27, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago

Description

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).

CVSS Details

Base Score
9.9
Exploitability
3.1
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
22.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-303

Affected Products 4

VendorProductVersionRange
mattermostmattermost_server*≥10.5.0  –  <10.5.13
mattermostmattermost_server*≥10.11.0  –  <10.11.5
mattermostmattermost_server*≥10.12.0  –  <10.12.2
mattermostmattermost_server*≥11.0.0  –  <11.0.3

References 1

  • mattermost.com https://mattermost.com/security-updates
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.