{"id":"GHSA-q66g-q98c-q454","revision":"7c36f4d89ef0446c81a7b764765be088","records":[{"revision":"7c36f4d89ef0446c81a7b764765be088","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-q66g-q98c-q454","aliases":["CVE-2025-62690","GO-2025-4248"],"title":"Mattermost has missing redirect URL validation","description":"Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.","state":0,"publishedAt":"2025-12-17T15:34:53+00:00","modifiedAt":"2026-01-14T20:26:48.145018+00:00","affected":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0-20250721062209-4952acea88ce"},{"kind":"fixed","version":"8.0.0-20251016131338-dad6bd7a1509"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.11.0-rc1"},{"kind":"fixed","version":"10.11.5-0.20251016131338-dad6bd7a1509"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"11.0.0-alpha.1"},{"kind":"fixed","version":"11.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-62690","https://github.com/mattermost/mattermost/commit/dad6bd7a1509054580a0898bbc0e026aac3b30cb","https://github.com/mattermost/mattermost","https://mattermost.com/security-updates"],"sourceUrl":"https://github.com/advisories/GHSA-q66g-q98c-q454","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q66g-q98c-q454","identifiers":["GHSA-q66g-q98c-q454","CVE-2025-62690","GO-2025-4248"]},"retained":false,"historicalAffected":[]}],"coverage":[]}