CVE-2026-22880 | THREATINT

Description

Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564

PUBLISHED Reserved 2026-02-23 | Published 2026-05-21 | Updated 2026-05-21 | Assigner Mattermost

MEDIUM: 6.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Problem types

CWE-352: Cross-Site Request Forgery (CSRF)

Product status

Default status

unaffected

Any version

affected

Any version

affected

Any version

affected

Any version

affected

Any version

affected

2.38.0

unaffected

11.5.0

unaffected

2.37.1.0

unaffected

11.4.1

unaffected

11.3.2

unaffected

11.2.4

unaffected

10.11.12

unaffected

Credits

Doyensec finder

References

mattermost.com/security-updates (MMSA-2025-00564) vendor-advisory

cve.org (CVE-2026-22880)

nvd.nist.gov (CVE-2026-22880)

Download JSON