CVE-2025-2571
4.2MEDIUMMattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to
Published: 5/30/2025Updated: 10/15/2025
Description
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.
AI AnalysisPowered by AI
Affected Products
mattermostmattermost_server
mattermostmattermost_server
mattermostmattermost_server
mattermostmattermost_server
References
- https://mattermost.com/security-updatesVendor Advisory