CVE-2026-22880
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Mattermost Mobile Apps versions up to 2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin, allowing an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application.
Risk Assessment
The organization may be at risk of user credential theft, potentially leading to unauthorized access to the Mattermost server.
Recommendation
It is recommended to update Mattermost Mobile Apps to the latest version containing the SSO origin validation fix.
Original NVD description (English source)
Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564