CVE-2025-9072CWE-601

CVE-2025-9072

High · published September 15, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2025-09-15T15:15Z
Affected products (3)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.5.0, < 10.5.1010.5.10
mattermost/mattermost_server≥ 10.9.0, < 10.9.510.9.5
mattermost/mattermost_server≥ 10.10.0, < 10.10.210.10.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 15 SEP 10:28Z
    One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter
    cvelistv5