x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-hm95-jx66-g2gh

Advisory [GHSA-hm95-jx66-g2gh](https://github.com/advisories/GHSA-hm95-jx66-g2gh) references a vulnerability in the following Go modules:

| Module |
| - |
| [github.com/mattermost/mattermost-server](https://pkg.go.dev/github.com/mattermost/mattermost-server) |

Description:
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs.

References:
- ADVISORY: https://github.com/advisories/GHSA-hm95-jx66-g2gh
- ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2025-9084
- FIX: https://github.com/mattermost/mattermost/commit/39bd251fe4f66b7e847fc6d653221886347ff160
- WEB: https://mattermost.com/security-updates

Cross references:
- github.com/mattermost/mattermost-server appears in 128 other report(s):
  - data/excluded/GO-2022-0601.yaml    (https://github.com/golang/vulndb/issues/601)    EFFECTIVELY_PRIVATE
  - data/excluded/GO-2022-1126.yaml    (https://github.com/golang/vulndb/issues/1126)    EFFECTIVELY_PRIVATE
  - data/excluded/GO-2022-1127.yaml    (https://github.com/golang/vulndb/issues/1127)    EFFECTIVELY_PRIVATE
  - data/excluded/GO-2023-1710.yaml    (https://github.com/golang/vulndb/issues/1710)    EFFECTIVELY_PRIVATE
  - data/reports/GO-2022-0540.yaml    (https://github.com/golang/vulndb/issues/540)
  - data/reports/GO-2022-0576.yaml    (https://github.com/golang/vulndb/issues/576)
  - data/reports/GO-2022-0595.yaml    (https://github.com/golang/vulndb/issues/595)
  - data/reports/GO-2022-0599.yaml    (https://github.com/golang/vulndb/issues/599)
  - data/reports/GO-2022-0604.yaml    (https://github.com/golang/vulndb/issues/604)
  - data/reports/GO-2022-0616.yaml    (https://github.com/golang/vulndb/issues/616)
  - data/reports/GO-2023-1939.yaml    (https://github.com/golang/vulndb/issues/1939)
  - data/reports/GO-2024-2444.yaml    (https://github.com/golang/vulndb/issues/2444)
  - data/reports/GO-2024-2446.yaml    (https://github.com/golang/vulndb/issues/2446)
  - data/reports/GO-2024-2448.yaml    (https://github.com/golang/vulndb/issues/2448)
  - data/reports/GO-2024-2450.yaml    (https://github.com/golang/vulndb/issues/2450)
  - data/reports/GO-2024-2541.yaml    (https://github.com/golang/vulndb/issues/2541)
  - data/reports/GO-2024-2566.yaml    (https://github.com/golang/vulndb/issues/2566)
  - data/reports/GO-2024-2588.yaml    (https://github.com/golang/vulndb/issues/2588)
  - data/reports/GO-2024-2589.yaml    (https://github.com/golang/vulndb/issues/2589)
  - data/reports/GO-2024-2590.yaml    (https://github.com/golang/vulndb/issues/2590)
  - data/reports/GO-2024-2591.yaml    (https://github.com/golang/vulndb/issues/2591)
  - data/reports/GO-2024-2592.yaml    (https://github.com/golang/vulndb/issues/2592)
  - data/reports/GO-2024-2593.yaml    (https://github.com/golang/vulndb/issues/2593)
  - data/reports/GO-2024-2594.yaml    (https://github.com/golang/vulndb/issues/2594)
  - data/reports/GO-2024-2595.yaml    (https://github.com/golang/vulndb/issues/2595)
  - data/reports/GO-2024-2635.yaml    (https://github.com/golang/vulndb/issues/2635)
  - data/reports/GO-2024-2695.yaml    (https://github.com/golang/vulndb/issues/2695)
  - data/reports/GO-2024-2696.yaml    (https://github.com/golang/vulndb/issues/2696)
  - data/reports/GO-2024-2706.yaml    (https://github.com/golang/vulndb/issues/2706)
  - data/reports/GO-2024-2707.yaml    (https://github.com/golang/vulndb/issues/2707)
  - data/reports/GO-2024-2793.yaml    (https://github.com/golang/vulndb/issues/2793)
  - data/reports/GO-2024-2794.yaml    (https://github.com/golang/vulndb/issues/2794)
  - data/reports/GO-2024-2795.yaml    (https://github.com/golang/vulndb/issues/2795)
  - data/reports/GO-2024-2796.yaml    (https://github.com/golang/vulndb/issues/2796)
  - data/reports/GO-2024-2797.yaml    (https://github.com/golang/vulndb/issues/2797)
  - data/reports/GO-2024-2798.yaml    (https://github.com/golang/vulndb/issues/2798)
  - data/reports/GO-2024-3020.yaml    (https://github.com/golang/vulndb/issues/3020)
  - data/reports/GO-2024-3022.yaml    (https://github.com/golang/vulndb/issues/3022)
  - data/reports/GO-2024-3023.yaml    (https://github.com/golang/vulndb/issues/3023)
  - data/reports/GO-2024-3024.yaml    (https://github.com/golang/vulndb/issues/3024)
  - data/reports/GO-2024-3025.yaml    (https://github.com/golang/vulndb/issues/3025)
  - data/reports/GO-2024-3028.yaml    (https://github.com/golang/vulndb/issues/3028)
  - data/reports/GO-2024-3030.yaml    (https://github.com/golang/vulndb/issues/3030)
  - data/reports/GO-2024-3031.yaml    (https://github.com/golang/vulndb/issues/3031)
  - data/reports/GO-2024-3032.yaml    (https://github.com/golang/vulndb/issues/3032)
  - data/reports/GO-2024-3089.yaml    (https://github.com/golang/vulndb/issues/3089)
  - data/reports/GO-2024-3090.yaml    (https://github.com/golang/vulndb/issues/3090)
  - data/reports/GO-2024-3091.yaml    (https://github.com/golang/vulndb/issues/3091)
  - data/reports/GO-2024-3092.yaml    (https://github.com/golang/vulndb/issues/3092)
  - data/reports/GO-2024-3093.yaml    (https://github.com/golang/vulndb/issues/3093)
  - data/reports/GO-2024-3094.yaml    (https://github.com/golang/vulndb/issues/3094)
  - data/reports/GO-2024-3096.yaml    (https://github.com/golang/vulndb/issues/3096)
  - data/reports/GO-2024-3097.yaml    (https://github.com/golang/vulndb/issues/3097)
  - data/reports/GO-2024-3164.yaml    (https://github.com/golang/vulndb/issues/3164)
  - data/reports/GO-2024-3227.yaml    (https://github.com/golang/vulndb/issues/3227)
  - data/reports/GO-2024-3232.yaml    (https://github.com/golang/vulndb/issues/3232)
  - data/reports/GO-2024-3233.yaml    (https://github.com/golang/vulndb/issues/3233)
  - data/reports/GO-2024-3234.yaml    (https://github.com/golang/vulndb/issues/3234)
  - data/reports/GO-2024-3235.yaml    (https://github.com/golang/vulndb/issues/3235)
  - data/reports/GO-2024-3334.yaml    (https://github.com/golang/vulndb/issues/3334)
  - data/reports/GO-2024-3337.yaml    (https://github.com/golang/vulndb/issues/3337)
  - data/reports/GO-2024-3338.yaml    (https://github.com/golang/vulndb/issues/3338)
  - data/reports/GO-2024-3340.yaml    (https://github.com/golang/vulndb/issues/3340)
  - data/reports/GO-2025-3377.yaml    (https://github.com/golang/vulndb/issues/3377)
  - data/reports/GO-2025-3379.yaml    (https://github.com/golang/vulndb/issues/3379)
  - data/reports/GO-2025-3380.yaml    (https://github.com/golang/vulndb/issues/3380)
  - data/reports/GO-2025-3392.yaml    (https://github.com/golang/vulndb/issues/3392)
  - data/reports/GO-2025-3393.yaml    (https://github.com/golang/vulndb/issues/3393)
  - data/reports/GO-2025-3394.yaml    (https://github.com/golang/vulndb/issues/3394)
  - data/reports/GO-2025-3407.yaml    (https://github.com/golang/vulndb/issues/3407)
  - data/reports/GO-2025-3480.yaml    (https://github.com/golang/vulndb/issues/3480)
  - data/reports/GO-2025-3481.yaml    (https://github.com/golang/vulndb/issues/3481)
  - data/reports/GO-2025-3482.yaml    (https://github.com/golang/vulndb/issues/3482)
  - data/reports/GO-2025-3483.yaml    (https://github.com/golang/vulndb/issues/3483)
  - data/reports/GO-2025-3534.yaml    (https://github.com/golang/vulndb/issues/3534)
  - data/reports/GO-2025-3549.yaml    (https://github.com/golang/vulndb/issues/3549)
  - data/reports/GO-2025-3550.yaml    (https://github.com/golang/vulndb/issues/3550)
  - data/reports/GO-2025-3551.yaml    (https://github.com/golang/vulndb/issues/3551)
  - data/reports/GO-2025-3552.yaml    (https://github.com/golang/vulndb/issues/3552)
  - data/reports/GO-2025-3555.yaml    (https://github.com/golang/vulndb/issues/3555)
  - data/reports/GO-2025-3556.yaml    (https://github.com/golang/vulndb/issues/3556)
  - data/reports/GO-2025-3604.yaml    (https://github.com/golang/vulndb/issues/3604)
  - data/reports/GO-2025-3609.yaml    (https://github.com/golang/vulndb/issues/3609)
  - data/reports/GO-2025-3610.yaml    (https://github.com/golang/vulndb/issues/3610)
  - data/reports/GO-2025-3611.yaml    (https://github.com/golang/vulndb/issues/3611)
  - data/reports/GO-2025-3618.yaml    (https://github.com/golang/vulndb/issues/3618)
  - data/reports/GO-2025-3619.yaml    (https://github.com/golang/vulndb/issues/3619)
  - data/reports/GO-2025-3620.yaml    (https://github.com/golang/vulndb/issues/3620)
  - data/reports/GO-2025-3621.yaml    (https://github.com/golang/vulndb/issues/3621)
  - data/reports/GO-2025-3622.yaml    (https://github.com/golang/vulndb/issues/3622)
  - data/reports/GO-2025-3623.yaml    (https://github.com/golang/vulndb/issues/3623)
  - data/reports/GO-2025-3642.yaml    (https://github.com/golang/vulndb/issues/3642)
  - data/reports/GO-2025-3642.yaml    (https://github.com/golang/vulndb/issues/3642)
  - data/reports/GO-2025-3642.yaml    (https://github.com/golang/vulndb/issues/3642)
  - data/reports/GO-2025-3643.yaml    (https://github.com/golang/vulndb/issues/3643)
  - data/reports/GO-2025-3643.yaml    (https://github.com/golang/vulndb/issues/3643)
  - data/reports/GO-2025-3643.yaml    (https://github.com/golang/vulndb/issues/3643)
  - data/reports/GO-2025-3644.yaml    (https://github.com/golang/vulndb/issues/3644)
  - data/reports/GO-2025-3644.yaml    (https://github.com/golang/vulndb/issues/3644)
  - data/reports/GO-2025-3644.yaml    (https://github.com/golang/vulndb/issues/3644)
  - data/reports/GO-2025-3691.yaml    (https://github.com/golang/vulndb/issues/3691)
  - data/reports/GO-2025-3692.yaml    (https://github.com/golang/vulndb/issues/3692)
  - data/reports/GO-2025-3693.yaml    (https://github.com/golang/vulndb/issues/3693)
  - data/reports/GO-2025-3694.yaml    (https://github.com/golang/vulndb/issues/3694)
  - data/reports/GO-2025-3724.yaml    (https://github.com/golang/vulndb/issues/3724)
  - data/reports/GO-2025-3728.yaml    (https://github.com/golang/vulndb/issues/3728)
  - data/reports/GO-2025-3729.yaml    (https://github.com/golang/vulndb/issues/3729)
  - data/reports/GO-2025-3730.yaml    (https://github.com/golang/vulndb/issues/3730)
  - data/reports/GO-2025-3731.yaml    (https://github.com/golang/vulndb/issues/3731)
  - data/reports/GO-2025-3756.yaml    (https://github.com/golang/vulndb/issues/3756)
  - data/reports/GO-2025-3757.yaml    (https://github.com/golang/vulndb/issues/3757)
  - data/reports/GO-2025-3769.yaml    (https://github.com/golang/vulndb/issues/3769)
  - data/reports/GO-2025-3771.yaml    (https://github.com/golang/vulndb/issues/3771)
  - data/reports/GO-2025-3772.yaml    (https://github.com/golang/vulndb/issues/3772)
  - data/reports/GO-2025-3796.yaml    (https://github.com/golang/vulndb/issues/3796)
  - data/reports/GO-2025-3797.yaml    (https://github.com/golang/vulndb/issues/3797)
  - data/reports/GO-2025-3818.yaml    (https://github.com/golang/vulndb/issues/3818)
  - data/reports/GO-2025-3819.yaml    (https://github.com/golang/vulndb/issues/3819)
  - data/reports/GO-2025-3820.yaml    (https://github.com/golang/vulndb/issues/3820)
  - data/reports/GO-2025-3901.yaml    (https://github.com/golang/vulndb/issues/3901)
  - data/reports/GO-2025-3902.yaml    (https://github.com/golang/vulndb/issues/3902)
  - data/reports/GO-2025-3903.yaml    (https://github.com/golang/vulndb/issues/3903)
  - data/reports/GO-2025-3904.yaml    (https://github.com/golang/vulndb/issues/3904)
  - data/reports/GO-2025-3905.yaml    (https://github.com/golang/vulndb/issues/3905)
  - data/reports/GO-2025-3906.yaml    (https://github.com/golang/vulndb/issues/3906)
  - data/reports/GO-2025-3907.yaml    (https://github.com/golang/vulndb/issues/3907)
  - data/reports/GO-2025-3910.yaml    (https://github.com/golang/vulndb/issues/3910)
  - data/reports/GO-2025-3911.yaml    (https://github.com/golang/vulndb/issues/3911)

See [doc/quickstart.md](https://github.com/golang/vulndb/blob/master/doc/quickstart.md) for instructions on how to triage this report.

```
id: GO-ID-PENDING
modules:
    - module: github.com/mattermost/mattermost-server
      versions:
        - introduced: 10.5.0+incompatible
        - fixed: 10.5.10+incompatible
      non_go_versions:
        - fixed: 8.0.0-202508080704-39bd251fe4f600
      vulnerable_at: 10.5.10-rc2+incompatible
summary: Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server
cves:
    - CVE-2025-9084
ghsas:
    - GHSA-hm95-jx66-g2gh
references:
    - advisory: https://github.com/advisories/GHSA-hm95-jx66-g2gh
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-9084
    - fix: https://github.com/mattermost/mattermost/commit/39bd251fe4f66b7e847fc6d653221886347ff160
    - web: https://mattermost.com/security-updates
source:
    id: GHSA-hm95-jx66-g2gh
    created: 2025-09-16T20:06:11.52600843Z
review_status: UNREVIEWED

```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-hm95-jx66-g2gh #3960

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-hm95-jx66-g2gh #3960

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions