Vulnerabilities fixed in Mattermost

Mattermost has fixed vulnerabilities in versions 11.0.x through 11.0.3, 10.12.x through 10.12.1, 10.11.x through 10.11.4 and 10.5.x through 10.5.12. The vulnerabilities allow an authenticated attacker to take over an account via a carefully crafted email address during the authentication process...

CVE-2025-12419

Mattermost contains an OAuth/OpenID Connect validation flaw where OAuth state tokens are not properly validated during authentication, enabling an authenticated attacker with team-creation privileges to take over a user account by manipulating data in the OAuth completion flow. The issue affects ...

EUVD-2023-32474

Malicious code in bioql PyPI...

CVE-2023-28848 CSRF protection on user_oidc login returned the expected token in case of an error

useroidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second...