{"id":"EUVD-2025-199827","revision":"efbd8912597b4f63a0dd0db8759dcb99","records":[{"revision":"efbd8912597b4f63a0dd0db8759dcb99","observedAt":"2026-10-29T21:51:28.845+00:00","statement":{"source":"euvd","id":"EUVD-2025-199827","aliases":["CVE-2025-12419","GHSA-3x39-62h4-f8j6"],"title":"Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation priv…","description":"Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":null}],"references":["https://mattermost.com/security-updates"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199827","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 27, 2025, 3:55:44 PM","dateUpdated":"Feb 26, 2026, 4:07:27 PM"},"relatedAdvisories":[{"id":"NCSC-2025-0378","title":"Kwetsbaarheden verholpen in Mattermost","vulnerabilityIds":["CVE-2025-12421","CVE-2025-12419"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-199827","identifiers":["EUVD-2025-199827","CVE-2025-12419","GHSA-3x39-62h4-f8j6"]},"retained":false,"historicalAffected":[]}],"coverage":[]}