OAuth Credential Leakage in Mattermost Bot Accounts

CVE-2025-2571

What is CVE-2025-2571?

Mattermost versions up to 10.7.0, 10.6.2, 10.5.3, and 9.11.12 are susceptible to a vulnerability where Google OAuth credentials are not adequately cleared during user account conversions to bot accounts. This oversight can lead to attackers exploiting the OAuth signup flow, obtaining unauthorized access to bot accounts. Organizations using affected Mattermost versions are urged to take immediate action to safeguard their accounts.

References