MEDIUM 6.5 Go
Mattermost does not enforce MFA on WebSocket connections
GHSA-xpg8-8xpv-948p · CVE-2025-55070 · GO-2025-4128
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Mattermost versions < 11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events.
Ready to move
Start Securing
Free, no credit card | First findings in minutes