CVE-2025-2571 — Google OAuth Authentication Bypass for Converted Bot Accounts

CVE-2025-2571

Google OAuth Authentication Bypass for Converted Bot Accounts PUBLISHED

Description (CNA)

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 10.7.0; affected 10.6.0 through 10.6.2; affected 10.5.0 through 10.5.3; affected 9.11.0 through 9.11.12; unaffected 10.8.0; unaffected 10.7.1; unaffected 10.6.3; unaffected 10.5.4; unaffected 9.11.13

CWE

CWE-303

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.