External risk intelligence

Mattermost Account Takeover Vulnerability via Email Authentication Flow

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-12421

Mattermost is a collaboration platform designed as an internet-facing or intranet-facing web application. As it commonly serves as a primary communication hub accessible via web browsers and mobile apps, its authentication endpoints are typically exposed to the network, making this service a common target for external and internal access.

Mattermost Server

10.5.0 to before 10.5.1310.11.0 to before 10.11.510.12.0 to before 10.12.211.0.0 to before 11.0.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Mattermost that could allow an authenticated user to take over another user's account. This issue arises from insufficient verification of authentication tokens during a code exchange process, potentially enabling unauthorized access if specific authentication settings are enabled. The main concern is confirming relevance and exposure.

Account takeover via email change.
Protects user accounts and data integrity.
Confirm if this impacts our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by initiating an account takeover. This requires the attacker to first be an authenticated user on the platform. With specific authentication settings enabled, the attacker can then manipulate their email address during an authentication method switch. By sending a specially crafted request to a specific endpoint, the attacker can hijack the account.

Authenticated user access required.
Specially crafted email via code exchange.
Account takeover and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user could take over another user's account by exploiting a flaw in how authentication tokens are verified during the code exchange process. This attack requires specific authentication settings to be enabled, potentially allowing an attacker to impersonate a legitimate user and gain unauthorized access to their account.

User account takeover.
Crafted email and token exchange.
Unauthorized access to user data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Mattermost Server, likely impacting application owners and platform teams responsible for its deployment and maintenance. The first practical step is to identify all instances of the affected Mattermost Server, confirm their network reachability and business criticality, and locate the specific owner for each instance to plan remediation.

Application and platform teams own remediation.
Verify exposed Mattermost instances and their configurations.
Plan targeted updates based on criticality and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mattermost Server?

Mattermost Server is an open-source collaboration platform that teams use for internal communication, messaging, and project coordination. It acts as a centralized hub where users exchange information, share files, and integrate various business tools, functioning as a web-based service typically hosted by an organization to manage their private communications.

What does CWE-303 mean for CVE-2025-12421?

CWE-303 refers to improper implementation of authentication, specifically when a system fails to verify that an authentication token belongs to the original session or flow. In the context of CVE-2025-12421, this means the software does not check if the token used during a code exchange matches the specific authentication path, allowing an attacker to swap data and gain unauthorized access to a different account.

How is this Mattermost vulnerability triggered?

An attacker must already be an authenticated user to attempt this. The bug is triggered by manipulating an email address during an authentication method switch and sending a specific request to the code exchange endpoint. The vulnerability is not triggered if RequireEmailVerification is enabled, as that setting forces an additional validation step that prevents the unauthorized account association.

Is my Mattermost instance at risk?

According to Halo Surface Signal, Mattermost is commonly deployed as an internet-facing communication hub, which often exposes its authentication endpoints to network traffic. If your instance is reachable via the internet or sits on a network where other users have access, it is a potential target. You should prioritize assessing instances that are configured to allow authentication method switching.

How do I respond to this threat?

Begin by auditing your Mattermost Server instances to identify which ones are running the affected versions. Check your current configuration settings to see if ExperimentalEnableAuthenticationTransfer is enabled and RequireEmailVerification is disabled. If both are true, plan to update your server software to a patched version immediately to resolve the authentication verification flaw.

References

mattermost.com/security-updates

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.