PT-2025-46874

CVE-2025-59480

Published

2025-10-15

Updated

2025-11-13

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions prior to 2.32.0

Description The Mattermost Mobile Apps do not properly validate Single Sign-On (SSO) redirect tokens to ensure they come from a trusted server. This allows a malicious Mattermost instance or an attacker positioned on the network path to steal user session credentials through specially crafted token-in-URL responses.

Recommendations Update Mattermost Mobile Apps to version 2.32.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Doyensec

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers