Account takeover on OAuth/OpenID-enabled servers

Summary

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.

Timeline

1. Nov 27, 2025, 3:55 PM UTCCVE published
2. Dec 2, 2025, 4:55 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Feb 26, 2026, 4:07 PM UTCRecord last updated

Affected versions

• Mattermost Mattermost

  From 10.12.0 · through 10.12.1; From 10.11.0 · through 10.11.4; From 10.5.0 · through 10.5.12; From 11.0.0 · through 11.0.3

• github.com/mattermost/mattermost/server/v8Go

  fixed in 8.0.0-20251028000919-d3ed703dc833

• github.com/mattermost/mattermost-serverGo

  From 10.12.0 · fixed in 10.12.2

• github.com/mattermost/mattermost-serverGo

  From 10.11.0 · fixed in 10.11.5

• github.com/mattermost/mattermost-serverGo

  From 10.5.0 · fixed in 10.5.13

• github.com/mattermost/mattermost-serverGo

  From 11.0.0 · fixed in 11.0.4

• github.com/mattermost/mattermost-serverGo

  All versions

• github.com/mattermost/mattermost-server/v5Go

  All versions

• github.com/mattermost/mattermost-server/v6Go

  All versions

References 1