CVE-2025-59480
Inadequate validation of SSO redirect credentials permits credential theft
Summary
Inadequate validation of SSO redirect credentials permits credential theft
Original description
The description as published by the source.
Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com