Skip to main content

Use of Weak Hash

CVE-2025-9078

Medium
4.3/10

Summary

Mattermost versions 9.11.x prior to 9.11.18, 10.5.x prior to 10.5.9, 10.8.x prior to 10.8.4, 10.9.x prior to 10.9.4, and 10.10.x prior to 10.10.2 fails to properly validate cache keys for link metadata, which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-328 - Use of Weak Hash

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

References

Advisory Timeline

  • Published