---
title: "Security digest: November 27, 2025"
url: https://erroneo.us/security/2025-11-27/
description: "November 27, 2025 vulnerability digest: 2 critical advisories (Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-11-27
date_modified: 2025-11-27
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: November 27, 2025

2 critical advisories.

## Take stock

- Go: 2 critical advisories ( github.com/mattermost/mattermost/server/v8 , github.com/mattermost/mattermost-server ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2025-12421](https://erroneo.us/security/cve/CVE-2025-12421/index.md) Mattermost fails to to verify the token used during code exchange — Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20251022210333-acda1fb5dd46 → 8.0.0-20251022210333-acda1fb5dd46; Go github.com/mattermost/mattermost-server >= 11.0.0, < 11.0.3 → 11.0.3; Go github.com/mattermost/mattermost-server >= 10.12.0, < 10.12.2 → 10.12.2
- [CVE-2025-12419](https://erroneo.us/security/cve/CVE-2025-12419/index.md) Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication — Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20251028000919-d3ed703dc833 → 8.0.0-20251028000919-d3ed703dc833; Go github.com/mattermost/mattermost-server >= 10.12.0, < 10.12.2 → 10.12.2; Go github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.5 → 10.11.5

---
Source page: https://erroneo.us/security/2025-11-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt