Description
Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.
Published: 2025-12-17
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Update Mattermost to versions 11.1.0, 10.11.5 or higher.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-q66g-q98c-q454 Mattermost has missing redirect URL validation
References
Link Providers
https://mattermost.com/security-updates cve-icon cve-icon
History

Mon, 29 Dec 2025 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Mattermost mattermost Server
CPEs cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
Vendors & Products Mattermost mattermost Server

Wed, 17 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Mattermost
Mattermost mattermost
Vendors & Products Mattermost
Mattermost mattermost

Wed, 17 Dec 2025 12:45:00 +0000

Type Values Removed Values Added
Description Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.
Title Open redirect in error page when link opened in new tab
Weaknesses CWE-601
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Mattermost Mattermost Mattermost Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Mattermost

Published:

Updated: 2025-12-17T14:45:57.830Z

Reserved: 2025-11-17T09:59:16.347Z

Link: CVE-2025-62690

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2025-12-17T13:15:58.510

Modified: 2025-12-29T18:55:05.180

Link: CVE-2025-62690

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-17T21:18:47Z

Weaknesses