CVE-2025-59480

MediumCVSS 6.1

Published: 13/11/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, allowing a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses.

Risk Assessment

This could enable session hijacking and unauthorized access to the user's account and data in Mattermost.

Recommendation

Update Mattermost Mobile Apps to a version above 2.32.0 that includes the fix.

Other vulnerabilities in Mattermost Mobile Apps

CVE-2026-22880Medium
Mattermost Mobile Apps versions up to 2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin, allowing an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application.

Original NVD description (English source)

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses

Vulnerability data from NVD (NIST) · CISA KEV · EPSS