Introduction
Account takeover in an enterprise collaboration platform can expose sensitive discussions and business data. CVE-2025-12419 is a critical flaw in Mattermost's OpenID Connect authentication that lets authenticated users with elevated privileges assume the identity of any user in the system.
Mattermost is a widely adopted open-source messaging and collaboration platform. Government, enterprise, and regulated industries favor it for its on-premises deployment model and its integration with external identity providers. That flexibility and security focus make a flaw in its authentication especially serious.
Technical information
CVE-2025-12419 comes from improper validation of the OAuth state parameter during OpenID Connect authentication in Mattermost. The state parameter exists to tie an authentication response to the request that started it, which prevents cross-site request forgery and session fixation attacks. In affected versions, Mattermost does not sufficiently verify that the state value returned in the OAuth response matches the value sent in the original request.
An attacker who already has an authenticated session and either team creation or admin privileges can manipulate the OAuth flow. The attacker can start an OAuth request for themselves, alter the state or authentication data, and then complete the flow so that Mattermost accepts the response as if it belonged to the target user. The result is a full takeover of the victim's account, including access to private channels, messages, and, if the target is an admin, administrative functions.
The vulnerability is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm). It affects Mattermost deployments configured to use OpenID Connect for authentication. The attacker does not need the victim's credentials, only the ability to manipulate the OAuth flow, which the insufficient state validation provides.
Affected systems and versions
- Mattermost 10.12.x up to and including 10.12.1
- Mattermost 10.11.x up to and including 10.11.4
- Mattermost 10.5.x up to and including 10.5.12
- Mattermost 11.0.x up to and including 11.0.3
All affected versions are vulnerable when configured to use OpenID Connect authentication. The external identity provider makes no difference (for example, Azure AD, Okta, or Google).
Vendor security history
Mattermost has a documented history of OAuth and authentication vulnerabilities. CVE-2025-58073, for example, involved a similar OAuth state manipulation issue in the team invitation flow. The vendor has a responsible disclosure policy, runs a bug bounty program, and ships regular security updates across all supported branches, including Extended Support Releases. Its updates and advisories are typically coordinated and come with clear versioning and upgrade guidance.
