CVE-2025-12421

🗓️ 27 Nov 2025 17:47:04Reported by MattermostType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 137 Views🌐 WEB

Mattermost code exchange allows account takeover if token origin is not verified; requires authentication transfer on and email verification off.

Reporter	Title	Published	Views	Family All 31
Circl	CVE-2025-12421	27 Nov 202519:23	–	circl
CNNVD	Mattermost 安全漏洞	27 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-12421 Account Takeover via Code Exchange Endpoint	27 Nov 202517:47	–	cvelist
EUVD	EUVD-2025-199833	27 Nov 202518:30	–	euvd
Github Security Blog	Mattermost fails to to verify the token used during code exchange	27 Nov 202518:30	–	github
Tenable Nessus	Mattermost Server 10.5.x <= 10.5.12 / 10.11.x <= 10.11.4 / 10.12.x <= 10.12.1 / 11.0.x <= 11.0.2 Multiple Vulnerabilities (CVE-2025-12421, MMSA-2025-00526, CVE-2025-12756)	10 Dec 202500:00	–	nessus
NCSC	Vulnerabilities fixed in Mattermost	28 Nov 202509:53	–	ncsc
NVD	CVE-2025-12421	27 Nov 202518:15	–	nvd
OSV	CVE-2025-12421	27 Nov 202518:15	–	osv
OSV	GHSA-MP6X-97XJ-9X62 Mattermost fails to to verify the token used during code exchange	27 Nov 202518:30	–	osv

NVD

Node

mattermost mattermost_serverRange10.5.0–10.5.13

mattermost mattermost_serverRange10.11.0–10.11.5

mattermost mattermost_serverRange10.12.0–10.12.2

mattermost mattermost_serverRange11.0.0–11.0.3

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "11.0.2",
        "status": "affected",
        "version": "11.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.12.1",
        "status": "affected",
        "version": "10.12.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.11.4",
        "status": "affected",
        "version": "10.11.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.5.12",
        "status": "affected",
        "version": "10.5.0",
        "versionType": "semver"
      },
      {
        "version": "11.1.0",
        "status": "unaffected"
      },
      {
        "version": "11.0.3",
        "status": "unaffected"
      },
      {
        "version": "10.12.2",
        "status": "unaffected"
      },
      {
        "version": "10.11.5",
        "status": "unaffected"
      },
      {
        "version": "10.5.13",
        "status": "unaffected"
      }
    ]
  }
]

Source	Link
mattermost	www.mattermost.com/security-updates

Parameter	Position	Path	Description	CWE
email	request body	/users/login/sso/code-exchange	Attacker-supplied email used during SSO code exchange can lead to account takeover when authentication flow tokens are not bound to the correct flow (requires ExperimentalEnableAuthenticationTransfer and Disable RequireEmailVerification).	CWE-303

17 Jun 2026 08:32Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.9

EPSS0.0031

SSVC

CWE-303