Listen to this Post
The vulnerability, CVE-2025-XXXX, exists within the `/users/login/sso/code-exchange` endpoint of the Mattermost server. During the OAuth-based authentication flow, when a user initiates a method switch (e.g., from email/password to SSO), the server generates an authorization code tied to a specific session. The flaw occurs because the server fails to validate that the token presented during the subsequent code exchange phase originates from the same initial authentication request context. Specifically, it does not securely bind the `state` parameter or session identifier from the initial request to the final token redemption.
An attacker, already authenticated under their own account, can exploit this by initiating an authentication transfer request with a specially crafted email address matching the victim’s account. By intercepting or predicting parameters, the attacker can then send a manipulated request to the code exchange endpoint. This request substitutes the victim’s identifier, causing the server to incorrectly associate the attacker’s ongoing SSO login with the victim’s account. This ultimately links the attacker’s SSO identity to the victim’s Mattermost profile, achieving a full account takeover. The exploit requires the `ExperimentalEnableAuthenticationTransfer` setting to be enabled (true by default) and `RequireEmailVerification` to be disabled (also the default).
Platform: Mattermost
Version: 11.0.0-11.0.2
Vulnerability: Account Takeover
Severity: Critical
date: 2025-11-27
Prediction: 2025-12-01
What Undercode Say:
curl -X POST https://TARGET/users/login/sso/code-exchange -d "code=ATTACKER_CODE&state=VICTIM_STATE"
Check server config for vulnerability conditions curl -s https://TARGET/api/v4/config/client | jq '.ExperimentalEnableAuthenticationTransfer, .RequireEmailVerification'
How Exploit:
Craft malicious email.
Trigger auth transfer.
Exchange code hijack.
Protection from this CVE:
Apply patched versions.
Disable ExperimentalEnableAuthenticationTransfer.
Enable RequireEmailVerification.
Impact:
Full account compromise.
Privilege escalation.
Data integrity loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
