Riskcovery

CVE-2025-62690

Open redirect in error page when link opened in new tab

State
Published
Severity
3.1 Low
Published
Dec 17, 2025
Updated
Dec 17, 2025
Reserved
Nov 17, 2025

Read the record on cve.org

Description

Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.

Scores

CVSSScoreVectorSource
3.13.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:NMattermost

Weaknesses

  • CWE-601 CWE‑601: URL Redirection to Untrusted Site (“Open Redirect”)

Affected Products

ProductVersions
MattermostMattermost
  • 10.11.0 through 10.11.4Affected
  • 11.1.0Not affected
  • 10.11.5Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.