cveboard RSS feed

CVE-2026-22880

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Mobile SSO authentication flow allows credential theft via malicious server

Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Mattermost

Vendor
Mattermost
Product
Mattermost
Platforms
Unknown
Default status
unaffected
Mattermost · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0affectedsemverUnavailable2.0.37None listed
0affectedsemverUnavailable11.0.4None listed
0affectedsemverUnavailable11.1.3None listed
0affectedsemverUnavailable11.3.2None listed
0affectedsemverUnavailable10.11.11None listed
2.38.0unaffectedUnavailableUnavailableUnavailableNone listed
11.5.0unaffectedUnavailableUnavailableUnavailableNone listed
2.37.1.0unaffectedUnavailableUnavailableUnavailableNone listed
11.4.1unaffectedUnavailableUnavailableUnavailableNone listed
11.3.2unaffectedUnavailableUnavailableUnavailableNone listed
11.2.4unaffectedUnavailableUnavailableUnavailableNone listed
10.11.12unaffectedUnavailableUnavailableUnavailableNone listed