What is the CVSS score of CVE-2026-22880?

CVE-2026-22880 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Mattermost Mobile CVE-2026-22880

Q: Which versions of Mattermost Mobile are affected by CVE-2026-22880?

SSO authentication callback origin validation failure in Mattermost Mobile Apps enables cross-server credential theft across multiple release branches (≤11.1.3, ≤11.3.2, ≤11.0.4, ≤10.11.11, ≤2.0.37).

EUVD-2026-31250 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-21 Mattermost

GHSA-j628-rc2h-qj7g

Microsoft CSRF Mattermost

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 09:34 vuln.today

DescriptionCVE.org

Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564

AnalysisAI

SSO authentication callback origin validation failure in Mattermost Mobile Apps enables cross-server credential theft across multiple release branches (≤11.1.3, ≤11.3.2, ≤11.0.4, ≤10.11.11, ≤2.0.37). An attacker operating a malicious Mattermost server can relay the SSO authorization code exchange through a victim's mobile application to authenticate against a separate, legitimate Mattermost server - stealing valid session credentials without the victim's awareness. No public exploit has been identified at time of analysis, and CVSS AC:H constrains this to targeted, engineered attacks rather than opportunistic mass exploitation.

Technical ContextAI

The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery) applied to the OAuth 2.0 SSO authorization code flow within the Mattermost Mobile App. In a correctly implemented OAuth flow, the mobile client validates that the SSO callback origin matches the server that initiated the authentication request - this origin binding is the CSRF protection mechanism for the code exchange. Here, the mobile app fails to enforce that check, meaning a malicious Mattermost server (which legitimately receives the SSO callback) can relay the authorization code to a different, legitimate Mattermost server to complete authentication on the attacker's behalf. The Microsoft tag in the intelligence data suggests the SSO identity provider involved may be Azure AD/Microsoft Entra, meaning stolen codes could grant access to workspaces using Microsoft-federated authentication. The affected CPE is cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, spanning all Mattermost mobile application variants across five distinct version branches.

RemediationAI

The primary fix is to upgrade Mattermost Mobile Apps beyond the affected version ceilings across all active release branches - consult the vendor advisory at https://mattermost.com/security-updates for exact patched release numbers, as specific fix versions are not independently confirmed from available data. As a targeted compensating control, organizations should instruct mobile users to connect only to explicitly allowlisted, verified Mattermost server URLs and to reject unexpected server connection prompts or workspace invitation links - this directly disrupts the attacker's requirement of directing victims to a malicious server. Where SSO/federated authentication (particularly Microsoft/Azure AD SSO) is not operationally required for mobile clients, disabling it eliminates this attack vector entirely, though at the cost of unified identity management convenience. Network-level controls restricting mobile clients to known Mattermost server endpoints can further limit exposure in managed device environments.