Authentication Bypass Vulnerability in Mattermost by Mattermost, Inc.

CVE-2025-25068

What is CVE-2025-25068?

Mattermost versions faced a significant vulnerability where multi-factor authentication (MFA) was not enforced on certain plugin endpoints. This oversight allows authenticated attackers to bypass MFA protections by exploiting API requests made to plugin-specific routes. Organizations using these affected versions are urged to assess their security posture and apply necessary patches or upgrades to mitigate potential risks.

References