CVE-2025-59480
Inadequate validation of SSO redirect credentials permits credential theft
Résumé
Inadequate validation of SSO redirect credentials permits credential theft
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com