CVE-2025-59480
BaseFortify
Publication date: 2025-11-13
Last updated on: 2025-11-13
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mobile_apps | 2.32.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Mattermost Mobile Apps versions up to 2.32.0, where the app fails to verify that Single Sign-On (SSO) redirect tokens come from a trusted server. This flaw allows a malicious Mattermost instance or an attacker positioned on the network path to capture user session credentials by sending specially crafted tokens in URL responses.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to user session credentials, potentially allowing attackers to hijack user sessions. This compromises user account security and may lead to unauthorized actions within the Mattermost environment.