CVE-2025-9072

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.0 through 10.5.9 Mattermost versions 10.9.0 through 10.9.4 Mattermost versions 10.10.0 through 10.10.1

Description Mattermost fails to validate the redirect to parameter, potentially allowing an attacker to craft a malicious link. Upon a user authenticating with their SAML provider, their cookies could be posted to a URL controlled by the attacker.

Recommendations Mattermost versions 10.5.0 through 10.5.9: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mattermost versions 10.9.0 through 10.9.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mattermost versions 10.10.0 through 10.10.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability.