CVE-2025-13821: Mattermost Server Info Disclosure Flaw

CVE-2025-13821 Overview

CVE-2025-13821 is an Information Disclosure vulnerability affecting Mattermost Server that fails to properly sanitize sensitive data in WebSocket messages. This security flaw allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events.

The vulnerability exists across multiple Mattermost release branches, impacting organizations relying on this popular team collaboration platform. Authenticated attackers can leverage WebSocket message interception to gain access to highly sensitive authentication credentials, potentially leading to account takeover and lateral movement within an organization's infrastructure.

Critical Impact
Authenticated users can extract password hashes and MFA secrets through WebSocket message interception during routine profile updates and email verification workflows, enabling credential theft and potential bypass of multi-factor authentication protections.

Affected Products

Mattermost Server versions 11.1.x through 11.1.2
Mattermost Server versions 10.11.x through 10.11.9
Mattermost Server versions 11.2.x through 11.2.1

Discovery Timeline

2026-02-16 - CVE CVE-2025-13821 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-13821

Vulnerability Analysis

This vulnerability (tracked as Mattermost Advisory ID: MMSA-2025-00560) stems from improper data sanitization in WebSocket message handling within Mattermost Server. When users perform certain actions such as updating their profile nickname or triggering email verification events, the server broadcasts WebSocket messages that inadvertently include sensitive authentication data.

The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The network-based attack vector requires low privileges (an authenticated user account) and relies on user interaction to trigger the vulnerable events. While the attack complexity is low, the confidentiality impact is high as it exposes critical authentication secrets.

An attacker with a valid Mattermost account can monitor WebSocket traffic for specific event types associated with profile updates and email verification. When other users trigger these events, the unfiltered WebSocket payloads may contain password hash values and MFA secret keys that should never be transmitted to clients.

Root Cause

The root cause is insufficient output sanitization in the WebSocket event broadcasting mechanism. The Mattermost Server fails to filter sensitive fields from user objects before transmitting them over WebSocket connections. When certain user profile events occur, the server serializes user data including internal authentication fields (password hashes, MFA secrets) and broadcasts this information to connected WebSocket clients without proper redaction.

This represents a failure in the principle of least privilege—client-side applications should never receive authentication secrets, regardless of whether the recipient is authenticated.

Attack Vector

The attack vector is network-based and requires the attacker to have an authenticated session to the Mattermost server. The exploitation flow involves:

The attacker establishes a WebSocket connection to the Mattermost server using valid credentials
The attacker subscribes to or monitors WebSocket channels for user-related events
When a target user updates their profile nickname or triggers an email verification event, the server broadcasts an unsanitized WebSocket message
The attacker captures the WebSocket payload containing the victim's password hash and MFA secret
The attacker can then perform offline password cracking or clone the MFA token for account takeover

The vulnerability is particularly concerning in shared workspace environments where multiple users interact through the same Mattermost instance, as any authenticated user can potentially intercept credentials from other users.

Detection Methods for CVE-2025-13821

Indicators of Compromise

Unusual WebSocket connection patterns from user accounts, particularly connections remaining idle while monitoring for events
High volume of WebSocket subscriptions to user-related event channels from a single authenticated session
Evidence of credential stuffing or password spray attacks using internally-obtained password hashes
Unauthorized MFA token usage or MFA bypass attempts following profile update activities

Detection Strategies

Implement WebSocket traffic monitoring to detect abnormal message interception patterns from authenticated clients
Deploy network analysis tools to identify clients that maintain persistent WebSocket connections without typical user interaction
Monitor authentication logs for signs of credential reuse that may indicate offline hash cracking was successful
Review application logs for unusual patterns of profile nickname updates or email verification requests

Monitoring Recommendations

Enable verbose logging for WebSocket connections and message routing within Mattermost
Configure SIEM alerts for unusual authentication patterns that may indicate credential compromise from this vulnerability
Implement user behavior analytics (UBA) to detect accounts exhibiting reconnaissance-like WebSocket monitoring behavior
Audit MFA token usage for anomalies such as tokens being used from unexpected locations or devices

How to Mitigate CVE-2025-13821

Immediate Actions Required

Upgrade Mattermost Server to the latest patched version immediately (versions beyond 11.1.2, 10.11.9, and 11.2.1)
Force password resets for all users as a precautionary measure given potential credential exposure
Rotate MFA secrets for all users to invalidate any potentially compromised MFA tokens
Review access logs for signs of exploitation prior to patching

Patch Information

Mattermost has released security updates to address this vulnerability. Organizations should upgrade to the following minimum versions:

For 11.1.x branch: Upgrade to version 11.1.3 or later
For 10.11.x branch: Upgrade to version 10.11.10 or later
For 11.2.x branch: Upgrade to version 11.2.2 or later

Detailed patch information is available through the Mattermost Security Updates page.

Workarounds

Implement network segmentation to limit WebSocket traffic visibility between different user groups
Deploy a Web Application Firewall (WAF) capable of inspecting WebSocket traffic and filtering sensitive data patterns
Consider temporarily disabling profile nickname updates if immediate patching is not possible
Monitor and restrict the number of concurrent WebSocket connections per user account to limit monitoring capabilities

bash

# Configuration example - restrict WebSocket connections per user (if supported by reverse proxy)
# nginx rate limiting example for WebSocket upgrades
limit_req_zone $binary_remote_addr zone=ws_limit:10m rate=2r/s;

location /api/v4/websocket {
    limit_req zone=ws_limit burst=5 nodelay;
    proxy_pass http://mattermost_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}