Mattermost Mobile Apps Vulnerability Allows Unauthorized Access to User Sessions

CVE-2025-59480

What is CVE-2025-59480?

Versions of Mattermost Mobile Apps up to and including 2.32.0 contain a vulnerability where the system fails to properly verify that Single Sign-On (SSO) redirect tokens are coming from a trusted server. This oversight allows malicious instances of Mattermost or an on-path attacker to exploit the vulnerability and potentially gain access to user session credentials through crafted URL responses. Users of these versions should take immediate action to secure their systems.

References