GHSA-hm95-jx66-g2gh

ghsaUSosv

Mattermost Open Redirect vulnerability

view advisory published 2025-09-15Licence: CC-BY-4.0

Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-9084US	medium6.1	0.17% (7th)	—	2025-09-15
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://github.com/mattermost/mattermost/commit/39bd251fe4f66b7e847fc6d653221886347ff160WEB
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-9084ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan