Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Update Mattermost to versions 11.1.0, 10.11.5 or higher.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://mattermost.com/security-updates |
|
History
Wed, 17 Dec 2025 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab. | |
| Title | Open redirect in error page when link opened in new tab | |
| Weaknesses | CWE-601 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Mattermost
Published:
Updated: 2025-12-17T14:45:57.830Z
Reserved: 2025-11-17T09:59:16.347Z
Link: CVE-2025-62690
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-12-17T13:15:58.510
Modified: 2025-12-17T13:15:58.510
Link: CVE-2025-62690
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses