CVE-2025-59480CWE-352csrf

CVE-2025-59480

Medium · published November 13, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-11-13T23:15Z
Affected products (1)
ProductVersionsFixed in
mattermost/mattermost_mobile< 2.33.02.33.0
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 13 NOV 17:32Z
    Inadequate validation of SSO redirect credentials permits credential theft
    cvelistv5