CVE-2025-12421

Published Nov 27, 2025

Last updated 2 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-12421 is a critical account takeover vulnerability in Mattermost that affects versions 11.0.x through 11.0.2, 10.12.x through 10.12.1, 10.11.x through 10.11.4, and 10.5.x through 10.5.12. It stems from the application's failure to verify that the token used during the code exchange originates from the same authentication flow. The vulnerability allows an authenticated user to perform account takeover by using a specially crafted email address when switching authentication methods and sending a request to the `/users/login/sso/code-exchange` endpoint. Exploitation requires that `ExperimentalEnableAuthenticationTransfer` is enabled and `RequireEmailVerification` is disabled.

Description: Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
Source: responsibledisclosure@mattermost.com
NVD status: Analyzed
Products: mattermost_server

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

responsibledisclosure@mattermost.com: CWE-303

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "91D99F7F-B4EE-447C-9B77-82DD64B1D83A",
            "versionEndExcluding": "10.5.13",
            "versionStartIncluding": "10.5.0"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A8368192-621C-4043-827E-DB4F6946AD92",
            "versionEndExcluding": "10.11.5",
            "versionStartIncluding": "10.11.0"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ED48D731-6490-4DD5-94D4-EE4555BB93ED",
            "versionEndExcluding": "10.12.2",
            "versionStartIncluding": "10.12.0"
          },
          {
            "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A288B87-76F2-415B-8462-3D185EB7A9B3",
            "versionEndExcluding": "11.0.3",
            "versionStartIncluding": "11.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.