CVE-2025-59480

MEDIUM

Mattermost Mobile < 2.33.0 - CSRF

Title source: rule

Description

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses

References (1)

[Vendor Advisory] https://mattermost.com/security-updates

Scores

CVSS v3 6.1

EPSS 0.0002

EPSS Percentile 5.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Classification

CWE

CWE-352

Status published

Affected Products (1)

mattermost/mattermost_mobile < 2.33.0

Timeline

Published Nov 13, 2025

Tracked Since Feb 18, 2026