Listen to this Post
CVE‑2026‑22880 is an authentication bypass vulnerability in Mattermost Mobile Apps that stems from improper validation of the Single Sign‑On (SSO) authentication callback origin. Mattermost Mobile Apps versions up to 2.37, 11.4, 2.0.37, 11.0.4, 11.1.3, 11.3.2, and 10.11.11.0 are affected. The flaw allows an attacker who controls a malicious Mattermost server to steal valid user credentials from a legitimate Mattermost instance by relaying the SSO code exchange flow through the mobile application.
The vulnerability lies in the mobile app’s OAuth 2.0 / OpenID Connect SSO handshake. When a user authenticates via SSO, the app expects a callback from the authentication provider containing an authorization code. The app then exchanges this code for an access token by calling the Mattermost server’s token endpoint. In vulnerable versions, the app does not verify that the callback origin matches the server that initiated the authentication request. Consequently, a malicious Mattermost server can craft a specially formed callback URI that points to the legitimate server’s token endpoint, but the app accepts and processes it without validating the source.
An attacker sets up a rogue Mattermost server and tricks a user into interacting with it (e.g., via a phishing link or a malicious workspace invitation). When the user attempts to log in through the mobile app, the rogue server initiates an SSO flow with a legitimate identity provider (IdP). The IdP redirects back to the rogue server with an authorization code. Instead of completing the exchange itself, the rogue server relays this code to the mobile app, which then forwards it to the legitimate Mattermost server’s token endpoint. Because the app fails to verify that the callback came from the legitimate server, it accepts the code and obtains a valid access token for the victim’s account on the legitimate server. The attacker can then use this token to impersonate the victim.
This attack requires the user to have already configured SSO for the legitimate server and to be tricked into using the malicious server, but the impact is severe: complete account takeover without the user’s knowledge. Mattermost assigned advisory ID MMSA‑2025‑00564 to this issue. The CVSS v3.1 base score is 6.1 (MEDIUM) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N. The weakness is mapped to CWE‑352 (Cross‑Site Request Forgery). The NVD published this CVE on 2026‑05‑21, and fixed versions (e.g., 2.37.1) were made available earlier.
DailyCVE Form:
Platform: Mattermost Mobile Apps
Version: ≤2.37,11.4,2.0.37,11.0.4,11.1.3,11.3.2,10.11.11.0
Vulnerability: SSO Origin Validation Flaw
Severity: MEDIUM (CVSS 6.1)
date: 2026‑05‑21
Prediction: 2026‑02‑28
What Undercode Say:
Simulate a malicious SSO callback relay using curl Attacker-controlled server redirects user to malicious Mattermost server The malicious server captures the authorization code and relays it to the legitimate server Step 1: On attacker server, initiate SSO with IdP and get code curl -X GET "https://attacker-mattermost.com/oauth/authorize?response_type=code&client_id=...&redirect_uri=https://attacker-mattermost.com/callback" Step 2: Attacker server receives code, then crafts a malicious callback to the mobile app The mobile app (vulnerable) will forward this code to the legitimate token endpoint curl -X POST "https://legitimate-mattermost.com/oauth/token" \ -d "grant_type=authorization_code" \ -d "code=ATTACKER_PROVIDED_CODE" \ -d "client_id=...&client_secret=..." \ -d "redirect_uri=https://legitimate-mattermost.com/callback" The app does not validate that the callback origin matches the legitimate server, so the token exchange succeeds and the attacker obtains a valid access token.
Exploit:
An attacker deploys a malicious Mattermost server and lures a victim into authenticating through it via the mobile app. The rogue server intercepts the SSO authorization code and, instead of completing the exchange, passes it back to the mobile app. The app, lacking origin validation, forwards the code to the victim’s legitimate Mattermost server and returns the resulting access token to the attacker. The attacker then uses this token to fully access the victim’s account on the legitimate server, including messages, files, and administrative functions.
Protection:
Upgrade Mattermost Mobile Apps to a fixed version (e.g., 2.37.1 or later). The fix introduces a `verifyServerOrigin` function that validates the `srv` parameter and uses `sanitizeUrl` to normalize the URL before comparing it against the expected server identifier; if mismatched, the app rejects the callback. Organizations should also enforce the use of trusted SSO providers and educate users to avoid interacting with untrusted Mattermost servers.
Impact:
Successful exploitation leads to credential theft and full account compromise on the legitimate Mattermost server. An attacker can read, modify, and delete data, impersonate the victim in communications, and potentially escalate privileges if the victim has administrative roles. The attack is remote, requires user interaction, and has a high complexity due to the need for a malicious server, but the confidentiality impact is high (C:H) with no integrity or availability impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
