{"id":"EUVD-2025-199827","enisaUuid":"62eb6975-4b1b-3ae7-9de5-d2b36d998190","description":"Mattermost versions 10.12.x \u003c\u003d 10.12.1, 10.11.x \u003c\u003d 10.11.4, 10.5.x \u003c\u003d 10.5.12, 11.0.x \u003c\u003d 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.","datePublished":"Nov 27, 2025, 3:55:44 PM","dateUpdated":"Feb 26, 2026, 4:07:27 PM","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-12419\nGHSA-3x39-62h4-f8j6\n","assigner":"Mattermost","epss":0.37,"enisaIdProduct":[{"id":"89ebc7d0-5a7f-3057-a30e-504c0983e5b5","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.4"},{"id":"91a68d43-8273-30a9-b34d-21e2317b31ab","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.1"},{"id":"aba51dd3-574a-3de1-9edd-eb86ee39ced9","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.12"},{"id":"cf0a9530-bfdf-349e-81c6-5659cfdaa258","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.3"}],"enisaIdVendor":[{"id":"d3f507c0-9dab-37ea-a5f4-c616dec875e4","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"0eaf4e9c-bc91-31d5-8d70-3849034d5a59","vulnerability":{"id":"CVE-2025-12419","description":"Mattermost versions 10.12.x \u003c\u003d 10.12.1, 10.11.x \u003c\u003d 10.11.4, 10.5.x \u003c\u003d 10.5.12, 11.0.x \u003c\u003d 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.","datePublished":"Nov 27, 2025, 3:55:44 PM","dateUpdated":"Feb 26, 2026, 4:07:27 PM","status":"PUBLISHED","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-199827\n","assigner":"Mattermost","epss":0.37,"dataProcessed":"Nov 6, 2026, 7:17:28 AM","vulnerabilityProduct":[{"id":"2cf47cc5-a150-33ac-8a0a-a7195c7e5dc8","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.12"},{"id":"50b45925-f29f-312d-a378-8c38a161d247","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.1"},{"id":"8965e430-d690-3542-be86-3624e16f2275","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.4"},{"id":"b209d9e7-b772-3ca4-a676-8bf4af6c4ff4","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.3"}],"vulnerabilityVendor":[{"id":"87892796-3f9c-36ec-96de-7ed41f830188","vendor":{"name":"Mattermost"}}]}},{"id":"e365d16f-576a-380c-8d4e-28c3295635bd","vulnerability":{"id":"GHSA-3x39-62h4-f8j6","description":"Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication","datePublished":"Nov 27, 2025, 6:30:25 PM","dateUpdated":"Dec 17, 2025, 12:41:08 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-12419\nhttps://github.com/mattermost/mattermost/pull/34296\nhttps://github.com/mattermost/mattermost/commit/15364790cc277cfaa372693d2d5442b87f70fd42\nhttps://github.com/mattermost/mattermost/commit/364c2203de00fe0d8424b6b46d6f0eeb02a2539a\nhttps://github.com/mattermost/mattermost/commit/46b5c436bb3093cc1da3fa2455f93d4c52389eee\nhttps://github.com/mattermost/mattermost/commit/c3f4818afe46a7084740e809708ae22641c76d8d\nhttps://github.com/mattermost/mattermost/commit/d3ed703dc8330684952eb8d49a375bac6ea7b0c6\nhttps://github.com/advisories/GHSA-3x39-62h4-f8j6\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-199827\n","aliases":"CVE-2025-12419\nGHSA-3x39-62h4-f8j6\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"f8eaae39-84bf-38ed-a80f-b32e13e6e7e9","advisory":{"id":"NCSC-2025-0378","description":"Kwetsbaarheden verholpen in Mattermost","datePublished":"Nov 28, 2025, 9:53:42 AM","dateUpdated":"Nov 28, 2025, 9:53:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2025-12421\nCVE-2025-12419\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"7030d270-0a5e-30f6-b7f9-4369897a2e0c","product":{"name":"vers:unknown/*","vendor":{"name":"Cisco"}}},{"id":"8416951e-3aeb-3953-b264-dd3bfdb559f9","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}}}]}}]}