Critical · published November 27, 2025
🚨 An authenticated attacker can hijack user accounts with just a crafty manipulation of OAuth tokens! 🔥 Think of it like a VIP pass system at a concert where a mischievous attendee convinces security that they are someone else entirely — without proper checks, they waltz backstage and take over someone else's experience! An attacker with team creation privileges could effectively impersonate another user, accessing their messages and sensitive data, and even taking full control of accounts! The consequences could be absolutely devastating, leading to unauthorized actions and the potential compromise of multiple accounts.
Think of it like a VIP pass system at a concert where a mischievous attendee convinces security that they are someone else entirely — without proper checks, they waltz backstage and take over someone else's experience! This vulnerability stems from insufficient validation of OAuth state tokens during OpenID Connect authentication, allowing an attacker to leverage an SSO system to take ownership of user accounts under specific conditions.
An attacker with team creation privileges could effectively impersonate another user, accessing their messages and sensitive data, and even taking full control of accounts! The consequences could be absolutely devastating, leading to unauthorized actions and the potential compromise of multiple accounts. To secure your system, patch to the latest versions (10.12.2, 10.11.5, 10.5.13, 11.0.4) immediately. Also, ensure that email verification is enabled and review your OAuth settings to limit the risk of account takeovers. You've got this! With these steps, you can fortify your Mattermost setup and be a true security hero! 🦸♂️
| Product | Versions | Fixed in |
|---|---|---|
| mattermost/mattermost_server | ≥ 10.5.0, < 10.5.13 | 10.5.13 |
| mattermost/mattermost_server | ≥ 10.11.0, < 10.11.5 | 10.11.5 |
| mattermost/mattermost_server | ≥ 10.12.0, < 10.12.2 | 10.12.2 |
| mattermost/mattermost_server | ≥ 11.0.0, < 11.0.4 | 11.0.4 |