CVE-2026-22880

Mobile SSO authentication flow allows credential theft via malicious server

State: Published
Severity: 6.1 Medium
Published: May 21, 2026
Updated: May 21, 2026
Reserved: Feb 23, 2026

Description

Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N	Mattermost

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
MattermostMattermost	2.0.37 and earlierAffected 11.0.4 and earlierAffected 11.1.3 and earlierAffected 11.3.2 and earlierAffected 10.11.11 and earlierAffected 2.38.0Not affected 11.5.0Not affected 2.37.1.0Not affected 11.4.1Not affected 11.3.2Not affected 11.2.4Not affected 10.11.12Not affected

References

MMSA-2025-00564vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.