Mattermost OpenID Connect OAuth State Token Validation Vulnerability Allowing Account Takeover

A vulnerability exists in Mattermost versions 10.12.x through 10.12.1, 10.11.x through 10.11.4, 10.5.x through 10.5.12, and 11.0.x through 11.0.3. These versions fail to properly validate OAuth state tokens during OpenID Connect authentication. This flaw allows an authenticated attacker with team creation privileges to take over a user account by manipulating authentication data during the OAuth completion process. The attack requires email verification to be disabled (which is the default), and for the attacker to control two users in the SSO system, with one having never logged into Mattermost.

Impact

Exploitation of this vulnerability could lead to unauthorized account access and takeover.

Remediation

Users can upgrade to Mattermost versions 11.2.011.1.111.0.610.12.410.11.8, 11.1.010.11.510.5.13, or 11.1.010.11.5 to address this vulnerability.