Listen to this Post
The vulnerability occurs in Mattermost when using OpenID Connect for authentication. During the OAuth authorization flow, the application generates a state token to prevent CSRF attacks. This state token is supposed to be validated upon callback to ensure the authentication response is legitimate. However, affected versions fail to properly validate this token, allowing manipulation. An attacker with team creation privileges can intercept or craft OAuth responses. By controlling two users in the SSO system—where one has never logged into Mattermost—the attacker can initiate an OAuth login for a victim. During the completion flow, the attacker injects malicious authentication data, such as altering user identifiers. Since the state token isn’t validated, Mattermost accepts the manipulated data, linking the attacker’s SSO account to the victim’s Mattermost account. This effectively takes over the account, especially when email verification is disabled, which is the default. The attack requires OAuth/OpenID Connect to be enabled and the attacker to have access to both SSO accounts. The flaw stems from insufficient checks in the OAuth callback handler, where state parameters are compared without robust verification. This allows bypassing the intended security mechanism, leading to account compromise without the victim’s consent.
Platform: Mattermost
Version: Multiple affected versions
Vulnerability: OAuth state validation
Severity: Critical
date: Nov 27 2025
Prediction: Patched versions available
What Undercode Say:
!/bin/bash
Check Mattermost version
curl -s http://localhost:8065/api/v4/system/ping | grep version
Verify OAuth configuration
psql -U mattermost -c “SELECT FROM OAuthApps;”
Simulate state token issue
python3 -c “import hashlib; print(hashlib.sha256(b’invalid_state’).hexdigest())”
how Exploit:
Attacker with team creation privileges initiates OAuth for victim. Controls two SSO users—one unused in Mattermost. Manipulates authentication data during callback. Bypasses state token validation. Account takeover achieved.
Protection from this CVE
Upgrade to patched versions: 10.12.2, 10.11.5, 10.5.13, 11.0.4. Enable email verification. Review OAuth configurations. Restrict team creation privileges.
Impact:
Account takeover possible. Unauthorized access to data. Compromise of user sessions. Potential privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
