CVE-2025-13821: Mattermost Server Info Disclosure Flaw

CVE-2025-13821 Overview

CVE-2025-13821 is an Information Disclosure vulnerability affecting Mattermost Server that fails to properly sanitize sensitive data in WebSocket messages. This security flaw allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events.

The vulnerability exists across multiple Mattermost release branches, impacting organizations relying on this popular team collaboration platform. Authenticated attackers can leverage WebSocket message interception to gain access to highly sensitive authentication credentials, potentially leading to account takeover and lateral movement within an organization's infrastructure.

Critical Impact

Authenticated users can extract password hashes and MFA secrets through WebSocket message interception during routine profile updates and email verification workflows, enabling credential theft and potential bypass of multi-factor authentication protections.

Affected Products

• Mattermost Server versions 11.1.x through 11.1.2
• Mattermost Server versions 10.11.x through 10.11.9
• Mattermost Server versions 11.2.x through 11.2.1

Discovery Timeline

• 2026-02-16 - CVE CVE-2025-13821 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-13821

Vulnerability Analysis

This vulnerability (tracked as Mattermost Advisory ID: MMSA-2025-00560) stems from improper data sanitization in WebSocket message handling within Mattermost Server. When users perform certain actions such as updating their profile nickname or triggering email verification events, the server broadcasts WebSocket messages that inadvertently include sensitive authentication data.

The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The network-based attack vector requires low privileges (an authenticated user account) and relies on user interaction to trigger the vulnerable events. While the attack complexity is low, the confidentiality impact is high as it exposes critical authentication secrets.

An attacker with a valid Mattermost account can monitor WebSocket traffic for specific event types associated with profile updates and email verification. When other users trigger these events, the unfiltered WebSocket payloads may contain password hash values and MFA secret keys that should never be transmitted to clients.

Root Cause

The root cause is insufficient output sanitization in the WebSocket event broadcasting mechanism. The Mattermost Server fails to filter sensitive fields from user objects before transmitting them over WebSocket connections. When certain user profile events occur, the server serializes user data including internal authentication fields (password hashes, MFA secrets) and broadcasts this information to connected WebSocket clients without proper redaction.

This represents a failure in the principle of least privilege—client-side applications should never receive authentication secrets, regardless of whether the recipient is authenticated.

Attack Vector

The attack vector is network-based and requires the attacker to have an authenticated session to the Mattermost server. The exploitation flow involves:

1. The attacker establishes a WebSocket connection to the Mattermost server using valid credentials
2. The attacker subscribes to or monitors WebSocket channels for user-related events
3. When a target user updates their profile nickname or triggers an email verification event, the server broadcasts an unsanitized WebSocket message
4. The attacker captures the WebSocket payload containing the victim's password hash and MFA secret
5. The attacker can then perform offline password cracking or clone the MFA token for account takeover

The vulnerability is particularly concerning in shared workspace environments where multiple users interact through the same Mattermost instance, as any authenticated user can potentially intercept credentials from other users.

Detection Methods for CVE-2025-13821

Indicators of Compromise

• Unusual WebSocket connection patterns from user accounts, particularly connections remaining idle while monitoring for events
• High volume of WebSocket subscriptions to user-related event channels from a single authenticated session
• Evidence of credential stuffing or password spray attacks using internally-obtained password hashes
• Unauthorized MFA token usage or MFA bypass attempts following profile update activities

Detection Strategies

• Implement WebSocket traffic monitoring to detect abnormal message interception patterns from authenticated clients
• Deploy network analysis tools to identify clients that maintain persistent WebSocket connections without typical user interaction
• Monitor authentication logs for signs of credential reuse that may indicate offline hash cracking was successful
• Review application logs for unusual patterns of profile nickname updates or email verification requests

Monitoring Recommendations

• Enable verbose logging for WebSocket connections and message routing within Mattermost
• Configure SIEM alerts for unusual authentication patterns that may indicate credential compromise from this vulnerability
• Implement user behavior analytics (UBA) to detect accounts exhibiting reconnaissance-like WebSocket monitoring behavior
• Audit MFA token usage for anomalies such as tokens being used from unexpected locations or devices

How to Mitigate CVE-2025-13821

Immediate Actions Required

• Upgrade Mattermost Server to the latest patched version immediately (versions beyond 11.1.2, 10.11.9, and 11.2.1)
• Force password resets for all users as a precautionary measure given potential credential exposure
• Rotate MFA secrets for all users to invalidate any potentially compromised MFA tokens
• Review access logs for signs of exploitation prior to patching

Patch Information

Mattermost has released security updates to address this vulnerability. Organizations should upgrade to the following minimum versions:

• For 11.1.x branch: Upgrade to version 11.1.3 or later
• For 10.11.x branch: Upgrade to version 10.11.10 or later
• For 11.2.x branch: Upgrade to version 11.2.2 or later

Detailed patch information is available through the Mattermost Security Updates page.

Workarounds

• Implement network segmentation to limit WebSocket traffic visibility between different user groups
• Deploy a Web Application Firewall (WAF) capable of inspecting WebSocket traffic and filtering sensitive data patterns
• Consider temporarily disabling profile nickname updates if immediate patching is not possible
• Monitor and restrict the number of concurrent WebSocket connections per user account to limit monitoring capabilities

# Configuration example - restrict WebSocket connections per user (if supported by reverse proxy)
# nginx rate limiting example for WebSocket upgrades
limit_req_zone $binary_remote_addr zone=ws_limit:10m rate=2r/s;

location /api/v4/websocket {
    limit_req zone=ws_limit burst=5 nodelay;
    proxy_pass http://mattermost_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}