User-Agent version parser panic during session creation (CVE-2026-25783)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledserver/channels/app/login.go:170

   App.DoLogin

2. 1
   Step 01server/channels/api4/user.go:2129-2130

   After authentication succeeds, the login handler calls DoLogin with the original HTTP request, including the attacker-controlled User-Agent header.

   isMobileDevice := utils.IsMobileRequest(r)
   session, err := c.App.DoLogin(c.AppContext, w, r, user, deviceId, isMobileDevice, false, false)
   

3. 2
   Step 02server/channels/app/login.go:170-179

   DoLogin parses r.UserAgent() and asks getBrowserVersion for the version string that will be stored in the session props.

   ua := uasurfer.Parse(r.UserAgent())
   
   plat := getPlatformName(ua, r.UserAgent())
   os := getOSName(ua, r.UserAgent())
   bname := getBrowserName(ua, r.UserAgent())
   bversion := getBrowserVersion(ua, r.UserAgent())
   
   session.AddProp(model.SessionPropBrowser, fmt.Sprintf("%v/%v", bname, bversion))
   

4. 3
   Step 03server/channels/app/user_agent.go:107-124 (before fix)

   Before the patch, each special-case prefix indexed strings.Fields(afterVersion)[0] without confirming any field existed.

   if index := strings.Index(userAgentString, "Mattermost Mobile/"); index != -1 {
       afterVersion := userAgentString[index+len("Mattermost Mobile/"):]
       return limitStringLength(strings.Fields(afterVersion)[0], maxUserAgentVersionLength)
   }
   

5. 4
   Step 04server/channels/app/user_agent.go:112-143

   The patched version loops over known prefixes and only indexes the first field when len(fields) > 0; otherwise it falls back to getUAVersion.

   var versionPrefixes = []string{
       "Mattermost Mobile/",
       desktopAppVersionPrefix,
       "mmctl/",
       "Franz/",
   }
   
   func getBrowserVersion(ua *uasurfer.UserAgent, userAgentString string) string {
       for _, prefix := range versionPrefixes {
           if _, after, ok := strings.Cut(userAgentString, prefix); ok {
               if fields := strings.Fields(after); len(fields) > 0 {
                   return limitStringLength(fields[0], maxUserAgentVersionLength)
               }
           }
       }
       return getUAVersion(ua.Browser.Version)
   }
   

6. Sinkserver/channels/app/user_agent.go:134

   getBrowserVersion