CVE-2025-59480: Mattermost Mobile

Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days.

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses

Affected products

• Mattermost Mattermost Mobile: before 2.33.0 (fixed in 2.33.0)

Published 2025-11-13. Last modified 2026-06-17.