---
id: CVE-2025-62690
title: >-
  Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the
  /error page, which allows an attacker to redirect a victim to a malicious site
  via a crafted link opened in a new tab.
summary: >-
  Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the
  /error page, which allows an attacker to redirect a victim to a malicious site
  via a crafted link opened in a new tab.
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-601
vendor: mattermost
product: mattermost_server
affected:
  - 'mattermost_server >= 10.11.0, < 10.11.5'
patched:
  - mattermost_server 10.11.5
published: '2025-12-17'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62690'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
epss: 0.00149
epssPercentile: 0.03587
ingestedAt: '2026-10-13T11:23:51.117Z'
---

## Overview

Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.

## Affected

- `mattermost_server >= 10.11.0, < 10.11.5`

## Remediation

Upgrade past the affected range:

- `mattermost_server 10.11.5`