Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server
Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server
02 / AFFECTED SOFTWARE
Affected packages
59 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.
05 / REFERENCES
Further evidence
- https://github.com/advisories/GHSA-8cgx-9ccj-3gwr
- https://github.com/mattermost/mattermost/commit/04676582cdd26f4fdfa78fcf60a7f8745e6b27f5
- https://mattermost.com/security-updates
- https://nvd.nist.gov/vuln/detail/CVE-2025-2571
- https://github.com/mattermost/mattermost
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2571.json