EUVD-2026-31250
GHSA-j628-rc2h-qj7g
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Primary rating from Vendor (Mattermost) · only source for this CVE.
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564
AnalysisAI
SSO authentication callback origin validation failure in Mattermost Mobile Apps enables cross-server credential theft across multiple release branches (≤11.1.3, ≤11.3.2, ≤11.0.4, ≤10.11.11, ≤2.0.37). An attacker operating a malicious Mattermost server can relay the SSO authorization code exchange through a victim's mobile application to authenticate against a separate, legitimate Mattermost server - stealing valid session credentials without the victim's awareness. No public exploit has been identified at time of analysis, and CVSS AC:H constrains this to targeted, engineered attacks rather than opportunistic mass exploitation.
Technical ContextAI
The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery) applied to the OAuth 2.0 SSO authorization code flow within the Mattermost Mobile App. In a correctly implemented OAuth flow, the mobile client validates that the SSO callback origin matches the server that initiated the authentication request - this origin binding is the CSRF protection mechanism for the code exchange. Here, the mobile app fails to enforce that check, meaning a malicious Mattermost server (which legitimately receives the SSO callback) can relay the authorization code to a different, legitimate Mattermost server to complete authentication on the attacker's behalf. The Microsoft tag in the intelligence data suggests the SSO identity provider involved may be Azure AD/Microsoft Entra, meaning stolen codes could grant access to workspaces using Microsoft-federated authentication. The affected CPE is cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, spanning all Mattermost mobile application variants across five distinct version branches.
RemediationAI
The primary fix is to upgrade Mattermost Mobile Apps beyond the affected version ceilings across all active release branches - consult the vendor advisory at https://mattermost.com/security-updates for exact patched release numbers, as specific fix versions are not independently confirmed from available data. As a targeted compensating control, organizations should instruct mobile users to connect only to explicitly allowlisted, verified Mattermost server URLs and to reject unexpected server connection prompts or workspace invitation links - this directly disrupts the attacker's requirement of directing victims to a malicious server. Where SSO/federated authentication (particularly Microsoft/Azure AD SSO) is not operationally required for mobile clients, disabling it eliminates this attack vector entirely, though at the cost of unified identity management convenience. Network-level controls restricting mobile clients to known Mattermost server endpoints can further limit exposure in managed device environments.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today