6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55070

CVE-2025-55070: Mattermost does not enforce MFA on WebSocket connections

Mattermost versions < 11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-55070

CVE-2025-55070:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	< 11.1.0	11.1.0
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250912063506-7d8b7b5e4a60	8.0.0-20250912063506-7d8b7b5e4a60

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because Mattermost failed to enforce Multi-Factor Authentication (MFA) on WebSocket connections. The core of the issue lies in the WebConn.IsAuthenticated function within server/channels/app/platform/web_conn.go. In vulnerable versions, this function only checked for a valid session token and did not verify if the user had completed the MFA process.

When a user establishes a WebSocket connection, the WebConn.ShouldSendEvent function is called for each event to determine if the user is authorized to receive it. This function, in turn, calls WebConn.IsAuthenticated. Since the authentication check was incomplete, an attacker who had compromised a user's credentials could log in, establish a WebSocket connection, and start receiving real-time events and sensitive information without ever providing an MFA token. The attacker would effectively bypass the MFA control for all data transmitted over WebSockets.

The patch addresses this by renaming the original, insecure IsAuthenticated function to IsBasicAuthenticated and introducing a new, more secure IsAuthenticated function. This new function checks for both a valid session and MFA completion by calling a new IsMFAAuthenticated function. By fixing the authentication check, the ShouldSendEvent function now correctly prevents event transmission to users who have not completed MFA, thus closing the security hole.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.