← Back

CVE-2025-2571

nvd nist
Published: May 30, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.2
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 1.6 / Impact: 2.5
Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.

Affected (4)

Mattermost
1 product
Mattermost Server
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Server
From 10.5.0 to 10.5.4
Mattermost Server
From 10.6.0 to 10.6.3
Mattermost Server
From 10.7.0 to 10.7.1
Mattermost Server
From 9.11.0 to 9.11.13

Related CWEs

CWE-303
Incorrect Implementation of Authentication Algorithm
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.