Incorrect Implementation of Authentication Algorithm Affecting github.com/mattermost/mattermost/server/channels/app package, versions >=10.5.0 <10.5.13>=10.11.0 <10.11.5>=10.12.0 <10.12.2>=11.0.0-alpha.1 <11.0.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMMATTERMOSTMATTERMOSTSERVERCHANNELSAPP-14147543
- published28 Nov 2025
- disclosed27 Nov 2025
- creditdaw10
Introduced: 27 Nov 2025
NewCVE-2025-12421 (opens in a new tab)How to fix?
Upgrade github.com/mattermost/mattermost/server/channels/app to version 10.5.13, 10.11.5, 10.12.2, 11.0.3 or higher.
Overview
github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative
Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm. An attacker can gain unauthorized access to another user's account by leveraging a specially crafted email address when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint.
Note:
This is only exploitable if the ExperimentalEnableAuthenticationTransfer setting is enabled and the RequireEmailVerification setting is disabled.