VULNERABILITY INTELLIGENCE

CVE-2025-9084

CVSS score3.1 LOW
EPSS probability0.17%
CISA KEVNot currently listed
Published2025-09-15
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-601

Primary references