4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-2571

CVE-2025-2571: Mattermost fails to clear Google OAuth credentials

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-2571

CVE-2025-2571:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 10.7.0-rc1, < 10.7.1	10.7.1
github.com/mattermost/mattermost/server/v8	go	>= 10.0.0-rc1, < 10.5.4	10.5.4
github.com/mattermost/mattermost/server/v8	go	>= 9.0.0-rc1, < 9.11.13	9.11.13
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250414095146-04676582cdd2	8.0.0-20250414095146-04676582cdd2
github.com/mattermost/mattermost/server/v8	go	>= 10.6.0-rc1, < 10.6.3	10.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-2571) description states that Mattermost fails to clear Google OAuth credentials when converting user accounts to bot accounts. The provided commit 04676582cdd26f4fdfa78fcf60a7f8745e6b27f5 directly addresses this issue. The patch modifies the ConvertUserToBot function in server/channels/app/bot.go. Specifically, it adds a new block of code at the beginning of the function to check if the user has an AuthService (like Google OAuth) configured. If so, it explicitly calls UpdateUserAuth to set AuthService and AuthData to empty strings, effectively clearing the OAuth credentials before proceeding with the bot conversion. This indicates that the ConvertUserToBot function was the point where the OAuth credentials should have been cleared but were not, thus making it the vulnerable function. An attacker could exploit this by having an OAuth session for a regular user account, and if that account was converted to a bot, the OAuth credentials would persist, potentially allowing the attacker to take over the bot account through the OAuth flow. The fix ensures these credentials are wiped during the conversion process.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.