Mattermost: >> Mattermost Server >> 10.9.4 Security Vulnerabilities
Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.
CVSS Score
7.6
EPSS Score
0.0
Published
2025-09-15