10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-12421

CVE-2025-12421: Mattermost fails to to verify the token used during code exchange

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-12421

CVE-2025-12421:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20251022210333-acda1fb5dd46	8.0.0-20251022210333-acda1fb5dd46
github.com/mattermost/mattermost-server	go	>= 11.0.0, < 11.0.3	11.0.3
github.com/mattermost/mattermost-server	go	>= 10.12.0, < 10.12.2	10.12.2
github.com/mattermost/mattermost-server	go	>= 10.11.0, < 10.11.5	10.11.5
github.com/mattermost/mattermost-server	go	>= 10.5.0, < 10.5.13	10.5.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability existed because the /users/login/sso/code-exchange endpoint did not validate the type of token being used for authentication. The loginSSOCodeExchange function would consume any provided token as long as it was valid, without checking if it was intended for the SSO code exchange flow. The core of the vulnerability was in the ConsumeTokenOnce function, which was called down to the database layer (SqlTokenStore.ConsumeOnce), where the token was deleted from the database based only on its value, not its type. This allowed an attacker to generate a token from another authentication process (e.g., SAML authentication) and use it to take over a user's account through the SSO code exchange. The patch addresses this by introducing a tokenType parameter to the ConsumeTokenOnce function and its callers, ensuring that the token type is checked at every level, from the API handler down to the database query. Specifically, loginSSOCodeExchange now requires a token of type TokenTypeSSOCodeExchange.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.