Introduction
A single request can let an attacker hijack any user account in a Mattermost deployment if the wrong configuration is in place. That configuration is the default, so real-world deployments running default settings are exposed to critical account takeover attacks through CVE-2025-12421.
About Mattermost: Mattermost is an open-source, self-hosted collaboration platform used by enterprises and government agencies worldwide. It offers secure messaging, file sharing, and integrations, with a focus on compliance and data sovereignty. Its support for multiple authentication methods makes it a popular choice for organizations with complex identity requirements.
Technical Information
CVE-2025-12421 is a critical flaw in how Mattermost's authentication flow handles switching between authentication methods. It sits in the code exchange process at the /users/login/sso/code-exchange endpoint. When a user switches authentication methods (from email-password to OAuth, for example, or between different OAuth providers), Mattermost should verify that the authorization code used in the exchange comes from the same authentication session and is linked to the requesting user.
The root cause is that Mattermost does not properly verify the origin and binding of the token during the code exchange. An attacker who is already authenticated can craft a request with a specially formatted email address and a valid authorization code. Because Mattermost does not check that the code and the email address belong to the same authentication flow, the attacker can make it associate the code with a different user account. The attacker then has full control of the targeted account and never needs to know or guess the victim's credentials.
Exploitation depends on two configuration settings, and both must be in their default state. ExperimentalEnableAuthenticationTransfer must be enabled, which lets users switch authentication methods. RequireEmailVerification must be disabled, which means Mattermost does not require users to verify that they own an email address during authentication. Both are defaults in affected versions, so most deployments are at risk unless these settings have been changed.
As of the disclosure date, no public code snippets or exploit scripts are available for this vulnerability.
Affected Systems and Versions
- Mattermost 11.0.x up to and including 11.0.2
- Mattermost 10.12.x up to and including 10.12.1
- Mattermost 10.11.x up to and including 10.11.4
- Mattermost 10.5.x up to and including 10.5.12
The vulnerability requires:
ExperimentalEnableAuthenticationTransferenabled (default: enabled)RequireEmailVerificationdisabled (default: disabled)
Vendor Security History
Mattermost has had several authentication-related vulnerabilities in recent years. CVE-2025-12419 and CVE-2025-58073 were flaws in OAuth and SSO handling, and both could lead to account takeover. The vendor maintains a responsible disclosure policy and issues regular security updates. Still, the recurring authentication logic flaws indicate an area that needs ongoing attention and improvement.
