CVE-2025-13821
Last modified
CVE-2025-13821 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost Server | >= 10.11.0, < 10.11.10 |
| Mattermost | Mattermost Server | >= 11.1.0, < 11.1.3 |
| Mattermost | Mattermost Server | >= 11.2.0, < 11.2.2 |
References
- https://mattermost.com/security-updatesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-13821?
How severe is CVE-2025-13821?
How do I fix CVE-2025-13821?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-13815A weakness has been identified in moxi159753 Mogu Blog v2 up…9.8
- CVE-2025-13816A security vulnerability has been detected in moxi159753 Mog…8.8
- CVE-2025-13818Local privilege escalation vulnerability via insecure tempor…6.7
- CVE-2025-13819Open redirect in the web server component of MiR Robot and F…6.1
- CVE-2025-1382The Contact Us By Lord Linus WordPress plugin through 2.6 do…6.1
- CVE-2025-13820The Comments WordPress plugin before 7.6.40 does not proper…5.3
- CVE-2025-13822MCPHub in versions below 0.11.0 is vulnerable to authenticat…5.3
- CVE-2025-13823A security issue was found in the IPv6 stack in the Micro850…7.1
- CVE-2025-13824A security issue exists due to improper handling of malforme…8.7
- CVE-2025-13826Zervit's portable HTTP/web server is vulnerable to remote Do…8.2
- CVE-2025-13827Summary Arbitrary files can be uploaded via the GrapesJS Bui…8.8
- CVE-2025-13828SummaryA non privileged user can install and remove arbitrar…9
Are you affected by CVE-2025-13821?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST