CVE-2025-9084: Mattermost Server Redirect Vulnerability

CVE-2025-9084 Overview

CVE-2025-9084 is an open redirect vulnerability affecting Mattermost Server versions 10.5.x through 10.5.9. The flaw stems from improper validation of redirect URLs in the OAuth login flow. Attackers can craft malicious OAuth login URLs that redirect authenticated users to attacker-controlled sites. This vulnerability is tracked under CWE-601: URL Redirection to Untrusted Site.

The issue enables phishing and credential theft campaigns by abusing the trust users place in the legitimate Mattermost domain. Successful exploitation requires user interaction, typically clicking a crafted link.

Critical Impact
Attackers can leverage the trusted Mattermost domain to redirect users to phishing pages, harvest credentials, or deliver malware through crafted OAuth login URLs.

Affected Products

Mattermost Server 10.5.0 through 10.5.9
Deployments using OAuth-based authentication flows
Self-hosted and cloud Mattermost instances on affected 10.5.x releases

Discovery Timeline

2025-09-15 - CVE-2025-9084 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9084

Vulnerability Analysis

The vulnerability is an open redirect in the Mattermost OAuth login handler. The server accepts a redirect URL parameter as part of the OAuth authentication flow but fails to validate that the destination points to a trusted origin. An attacker crafts a URL that references the legitimate Mattermost host while embedding an external redirect target.

When a victim clicks the link and completes or bypasses the OAuth step, the application forwards the browser to the attacker-supplied destination. The victim sees the trusted Mattermost hostname in the initial URL, which lowers suspicion. Attackers commonly pair open redirects with lookalike phishing pages that mimic the Mattermost login screen to harvest session tokens or credentials.

The EPSS probability for CVE-2025-9084 sits at 0.161%, indicating low observed exploitation activity to date. However, open redirects are frequently chained with other flaws in real-world phishing kits.

Root Cause

The root cause is missing allowlist validation on the redirect URL parameter used during the OAuth login callback. The handler treats user-supplied redirect targets as trusted input and issues an HTTP redirect without verifying that the destination matches the configured site URL or an approved host.

Attack Vector

Exploitation requires the attacker to distribute a crafted link, for example through email, chat, or a compromised webpage. The link points to the legitimate Mattermost OAuth login endpoint with an attacker-controlled redirect parameter. Once the victim interacts with the link, the browser is sent to a domain the attacker controls, where phishing or drive-by download attacks proceed.

No authentication is required to construct the malicious URL, and the attack succeeds against any user of an unpatched Mattermost 10.5.x instance. See the Mattermost Security Updates advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-9084

Indicators of Compromise

Outbound OAuth login requests to Mattermost that contain external hostnames in redirect or redirect_uri parameters
Web server access logs showing HTTP 302 responses from OAuth endpoints redirecting to domains outside the configured SiteURL
User reports of unexpected login prompts or credential pages following a Mattermost link

Detection Strategies

Parse Mattermost access logs for OAuth endpoint requests carrying redirect parameters that reference non-allowlisted domains
Deploy web application firewall (WAF) rules that inspect the query string of OAuth login URLs and block off-domain redirect values
Correlate email gateway telemetry with Mattermost URLs containing suspicious redirect query strings to identify phishing campaigns

Monitoring Recommendations

Alert on any HTTP 3xx response from Mattermost OAuth endpoints whose Location header points outside the trusted domain
Track user-agent patterns and referrer chains associated with OAuth logins to spot automated abuse
Monitor Mattermost version banners across the estate to confirm all instances have been upgraded past 10.5.9

How to Mitigate CVE-2025-9084

Immediate Actions Required

Upgrade Mattermost Server to a patched release above version 10.5.9 as published in the Mattermost Security Updates advisory
Inventory all Mattermost deployments and confirm none remain on affected 10.5.x builds
Notify users about phishing risks and instruct them to inspect the final destination of Mattermost links before entering credentials

Patch Information

Mattermost released fixed versions addressing the redirect validation flaw. Consult the Mattermost Security Updates page for the exact patched version and upgrade guidance. Apply the update to all self-hosted instances and verify cloud tenants are on a current build.

Workarounds

Configure upstream reverse proxies or WAFs to strip or validate redirect parameters on Mattermost OAuth endpoints until patching completes
Restrict outbound redirects to an allowlist of internal hostnames using proxy-level URL rewriting
Disable or limit OAuth-based authentication providers where feasible until the upgrade is deployed

bash

# Example NGINX rule to block off-domain redirect parameters on OAuth endpoints
location ~ ^/oauth/ {
    if ($arg_redirect_to ~* "^https?://(?!mattermost\.example\.com)") {
        return 400;
    }
    proxy_pass http://mattermost_upstream;
}