CVE-2025-59480 — Inadequate validation of SSO redirect credentials permits credential theft

CVE-2025-59480

Inadequate validation of SSO redirect credentials permits credential theft PUBLISHED

Description (CNA)

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 2.32.0; unaffected 2.33.0

CWE

CWE-352

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.