CVE-2025-12421

🗓️ 27 Nov 2025 17:47:04Reported by MattermostType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 190 Views🌐 WEB

Mattermost code exchange allows account takeover if token origin is not verified; requires authentication transfer on and email verification off.

Reporter	Title	Published	Views	Family All 32
BDU FSTEC	The vulnerability of the Mattermost instant messaging application, related to the improper implementation of authentication algorithms, allows attackers to circumvent security restrictions and gain unauthorized access to protected information.	5 Dec 202500:00	–	bdu_fstec
Circl	CVE-2025-12421	27 Nov 202519:23	–	circl
CNNVD	Mattermost 安全漏洞	27 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-12421 Account Takeover via Code Exchange Endpoint	27 Nov 202517:47	–	cvelist
EUVD	EUVD-2025-199833	27 Nov 202518:30	–	euvd
Github Security Blog	Mattermost fails to to verify the token used during code exchange	27 Nov 202518:30	–	github
Tenable Nessus	Mattermost Server 10.5.x <= 10.5.12 / 10.11.x <= 10.11.4 / 10.12.x <= 10.12.1 / 11.0.x <= 11.0.2 Multiple Vulnerabilities (CVE-2025-12421, MMSA-2025-00526, CVE-2025-12756)	10 Dec 202500:00	–	nessus
NCSC	Vulnerabilities fixed in Mattermost	28 Nov 202509:53	–	ncsc
NVD	CVE-2025-12421	27 Nov 202518:15	–	nvd
OSV	CVE-2025-12421 Account Takeover via Code Exchange Endpoint	27 Nov 202517:47	–	osv

NVD

Node

mattermost mattermost_serverRange10.5.0–10.5.13

mattermost mattermost_serverRange10.11.0–10.11.5

mattermost mattermost_serverRange10.12.0–10.12.2

mattermost mattermost_serverRange11.0.0–11.0.3

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "11.0.2",
        "status": "affected",
        "version": "11.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.12.1",
        "status": "affected",
        "version": "10.12.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.11.4",
        "status": "affected",
        "version": "10.11.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.5.12",
        "status": "affected",
        "version": "10.5.0",
        "versionType": "semver"
      },
      {
        "version": "11.1.0",
        "status": "unaffected"
      },
      {
        "version": "11.0.3",
        "status": "unaffected"
      },
      {
        "version": "10.12.2",
        "status": "unaffected"
      },
      {
        "version": "10.11.5",
        "status": "unaffected"
      },
      {
        "version": "10.5.13",
        "status": "unaffected"
      }
    ]
  }
]

Source	Link
mattermost	www.mattermost.com/security-updates

Parameter	Position	Path	Description	CWE
email	request body	users/login/sso/code-exchange	Token exchange lacks origin verification allowing account takeover via crafted email during SSO flow	CWE-303
token	request body	users/login/sso/code-exchange	Token exchange lacks origin verification allowing account takeover via crafted email during SSO flow	CWE-303

17 Jun 2026 08:32Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.9

EPSS0.00317

SSVC

CWE-303