CVE-2025-13821: 
vulnerability analysis and mitigation

CVE-2025-13821 is an information disclosure vulnerability in Mattermost Server that fails to sanitize sensitive data in WebSocket messages, allowing authenticated users to exfiltrate password hashes and MFA secrets. It affects Mattermost Server versions 10.11.x ≤ 10.11.9, 11.1.x ≤ 11.1.2, and 11.2.x ≤ 11.2.1. The vulnerability was published on February 16, 2026, and is tracked under Mattermost Advisory ID MMSA-2025-00560. It carries a CVSS v3.1 base score of 5.7 (Medium) (Red Hat CVE, Mattermost Security).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): Mattermost Server does not properly sanitize sensitive fields — specifically password hashes and MFA secrets — before including them in WebSocket event messages. These sensitive fields are inadvertently broadcast to authenticated users during specific server-side events, namely profile nickname updates and email verification events. An authenticated attacker can listen to WebSocket messages on the Mattermost platform and capture the unsanitized credential material without requiring elevated privileges. Exploitation requires the attacker to be an authenticated user and to trigger or observe the relevant profile update or email verification events (Red Hat CVE, Mattermost Security).

Successful exploitation allows an authenticated attacker to obtain other users' password hashes and MFA (multi-factor authentication) secrets, directly undermining both authentication and MFA controls. Exfiltrated password hashes can be subjected to offline cracking attacks, potentially leading to full account compromise, while stolen MFA secrets enable complete bypass of two-factor authentication protections. The impact is limited to confidentiality (no integrity or availability impact), but the exposure of credential material significantly elevates the risk of account takeover and lateral movement within the Mattermost environment (Red Hat CVE).

1. Authenticate: Obtain valid credentials for any user account on the target Mattermost Server instance running an affected version (10.11.x ≤ 10.11.9, 11.1.x ≤ 11.1.2, or 11.2.x ≤ 11.2.1).
2. Establish WebSocket connection: Using a WebSocket client or browser developer tools, connect to the Mattermost WebSocket endpoint (typically wss://<server>/api/v4/websocket) with a valid authentication token.
3. Trigger the vulnerable event: Either update a user's profile nickname or initiate an email verification event on the target account. This can be done via the Mattermost API or UI.
4. Capture WebSocket messages: Monitor incoming WebSocket messages during the triggered event. The server will broadcast an event message containing unsanitized user data, including password hash and MFA secret fields.
5. Extract credential material: Parse the WebSocket event payload to extract the password hash and/or MFA (TOTP) secret for the targeted user account.
6. Offline cracking / MFA bypass: Use the extracted password hash with offline cracking tools (e.g., Hashcat) to recover plaintext passwords, or use the MFA secret to generate valid TOTP codes for authentication bypass (Red Hat CVE, Mattermost Security).

• Network: Unusual or persistent WebSocket connections from authenticated users that remain open for extended periods without corresponding UI activity; WebSocket traffic capturing profile update or email verification events from unexpected client IPs.
• Logs: Mattermost server logs showing repeated profile nickname update API calls (PUT /api/v4/users/{user_id}/patch) or email verification triggers from a single authenticated user targeting multiple accounts; anomalous access patterns in the Mattermost audit log.
• Behavioral: A single authenticated user account triggering a high volume of profile update or email verification events in a short timeframe, particularly across multiple user accounts.

Mattermost has released patched versions addressing this vulnerability. Administrators should upgrade to Mattermost Server 10.11.10 or later, 11.1.3 or later, or 11.2.2 or later as soon as possible. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation. Additionally, organizations should consider monitoring WebSocket activity for anomalous patterns and implementing network segmentation to limit unnecessary WebSocket exposure (Mattermost Security, Red Hat CVE).

A technical write-up was published at infinitsec.net shortly after disclosure, detailing how user profile updates expose password hashes and MFA secrets via this vulnerability. Red Hat also tracked and published the CVE through their security advisory system. No significant broader media coverage or notable researcher commentary beyond initial disclosure has been identified at this time (Red Hat CVE).