CVE-2025-59480 — Inadequate validation of SSO redirect credentials permits credential theft
Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attac…
Published: 2025-11-13 · CVSS: 6.1 · CVSS 3.1
Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7