What is GHSA-q66g-q98c-q454?

GHSA-q66g-q98c-q454 is a security advisory published by GitHub Security Advisories with Low severity. Mattermost has missing redirect URL validation

Which CVE IDs does GHSA-q66g-q98c-q454 cover?

GHSA-q66g-q98c-q454 covers the following CVE IDs: CVE-2025-62690. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q66g-q98c-q454?

GHSA-q66g-q98c-q454 has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-q66g-q98c-q454?

GHSA-q66g-q98c-q454 affects 3 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 8.0.0-20250721062209-4952acea88ce, \u003c 8.0.0-20251016131338-dad6bd7a1509; go/github.com/mattermost/mattermost:\u003e= 10.11.0-rc1, \u003c 10.11.5-0.20251016131338-dad6bd7a1509; go/github.com/mattermost/mattermost:\u003e= 11.0.0-alpha.1, \u003c 11.1.0.

GHSA-q66g-q98c-q454LowCVSS 3.1

Mattermost has missing redirect URL validation

Vendor

GitHub Security Advisories

Published

December 17, 2025

Last Modified

December 18, 2025

🔗 CVE IDs covered (1)

CVE-2025-62690 →

📋 Description

Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.

🎯 Affected products3

go/github.com/mattermost/mattermost/server/v8:>= 8.0.0-20250721062209-4952acea88ce, < 8.0.0-20251016131338-dad6bd7a1509
go/github.com/mattermost/mattermost:>= 10.11.0-rc1, < 10.11.5-0.20251016131338-dad6bd7a1509
go/github.com/mattermost/mattermost:>= 11.0.0-alpha.1, < 11.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-62690
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost/commit/dad6bd7a1509054580a0898bbc0e026aac3b30cb
https://github.com/advisories/GHSA-q66g-q98c-q454