Critical · published November 27, 2025
🚨 A crafty email could turn an authenticated user into a malicious supervillain! This Mattermost vulnerability allows account takeover due to improper token verification. 🔥 Think of it like a restaurant where a diner can switch their meal at the last minute without the staff checking their reservation—who knows what they might order next! An attacker can hijack an account, gain full access, and wreak havoc by sending malicious requests to the system. This could mean unauthorized data access, system manipulation, or even a complete takeover of user accounts, which is absolutely devastating!
Think of it like a restaurant where a diner can switch their meal at the last minute without the staff checking their reservation—who knows what they might order next! CVE-2025-12421 arises because Mattermost fails to verify that the token used in the code exchange comes from the same authentication flow. When ExperimentalEnableAuthenticationTransfer is enabled and RequireEmailVerification is disabled, this flaw can be exploited.
An attacker can hijack an account, gain full access, and wreak havoc by sending malicious requests to the system. This could mean unauthorized data access, system manipulation, or even a complete takeover of user accounts, which is absolutely devastating! Immediately patch Mattermost to version 11.0.3 or 10.12.2, and ensure that RequireEmailVerification is enabled in your configuration settings. Review your security policies to minimize exposure to this vulnerability. You've got this! Follow these steps to secure your Mattermost installation and keep your users safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mattermost/mattermost_server | ≥ 10.5.0, < 10.5.13 | 10.5.13 |
| mattermost/mattermost_server | ≥ 10.11.0, < 10.11.5 | 10.11.5 |
| mattermost/mattermost_server | ≥ 10.12.0, < 10.12.2 | 10.12.2 |
| mattermost/mattermost_server | ≥ 11.0.0, < 11.0.3 | 11.0.3 |