CVE-2025-9084: Open redirect in OAuth login
Published Sep 15, 2025
·Updated
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs
Affected Software
4 affected componentsFixes available
Mattermost Mattermost<=10.5.9
Mattermost Mattermost Server>=10.5.0<10.5.10
go/github.com/mattermost/mattermost-server>=10.5.0<10.5.10
10.5.10
go/github.com/mattermost/mattermost/server/v8<8.0.0-202508080704-39bd251fe4f600
8.0.0-202508080704-39bd251fe4f600
Remediation
Information
Update Mattermost to versions 10.11.0, 10.5.10 or higher.
Event History
Sep 15, 2025
CVE Published
via MITRE·10:22 AM
Data Sourced
via MITRE·10:22 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·12:31 PM
Data Sourced
via GitHub·12:31 PM
DescriptionSeverityWeaknessAffected Software
Feb 28, 57989
Event
via FIRST·06:20 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-9084?
CVE-2025-9084 is considered a high severity vulnerability due to its potential to redirect users to malicious sites.
2
How do I fix CVE-2025-9084?
To fix CVE-2025-9084, upgrade Mattermost to version 10.5.10 or later where the validation of redirect URLs is properly implemented.
3
Who is affected by CVE-2025-9084?
CVE-2025-9084 affects Mattermost versions 10.5.x up to and including 10.5.9.
4
What type of attack does CVE-2025-9084 enable?
CVE-2025-9084 allows attackers to execute open redirect attacks via crafted OAuth login URLs.
5
Can CVE-2025-9084 lead to data exposure?
Yes, CVE-2025-9084 can potentially lead to data exposure if users are redirected to malicious sites designed to steal their information.