CVE-2025-13821: Mattermost fails to sanitize sensitive data in WebSocket messages

February 16, 2026 (updated February 19, 2026)

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560

References

github.com/advisories/GHSA-pp9j-pf5c-659x
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/cd17b61de41bf0a49b524bb91ce0bbe859e5a100
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-13821

Code Behaviors & Features

Detect and mitigate CVE-2025-13821 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →