CVE-2025-2571 MEDIUM

CVE-2025-2571: Google OAuth Authentication Bypass for Converted Bot Accounts

Vendor Mattermost
Product Mattermost
Weakness CWE-303
Published May 30, 2025
Last update May 30, 2025
View on NVD All CVEs

CVSS base score

4.2/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.

Key dates

02Disclosure timeline

May 30, 2025 CVE published
May 30, 2025 Record updated