CVE-2025-9084 LOW

CVE-2025-9084: Open redirect in OAuth login

Vendor Mattermost
Product Mattermost
Weakness CWE-601 · Open redirect
Published September 15, 2025
Last update September 15, 2025
View on NVD All CVEs

CVSS base score

3.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs

Key dates

02Disclosure timeline

September 15, 2025 CVE published
September 15, 2025 Record updated