CVE-2024-45833: Mobile password gets saved in dictionary under conditions

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-16 · updated 2026-06-17
Weakness: CWE-693

Description

Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a special character..

Affected products

Mattermost Mobile: before 2.19.0 — fixed in 2.19.0

How to fix

Upgrade to a fixed version: Mattermost Mobile 2.19.0. Check the vendor advisory for mitigations.

References

https://mattermost.com/security-updates

Get alerted when CVE-2024-45833 or the next vulnerability affects your stack