Vulnerability · Published May 21, 2026 · Assigned by Mattermost

CVE-2026-22880Mobile SSO authentication flow allows credential theft via malicious server

Medium 6.1

In plain English

A medium-severity cross-site request forgery in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.1%top 98.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	0 – through 2.0.370 – through 11.0.40 – through 11.1.30 – through 11.3.20 – through 10.11.11

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

References

MMSA-2025-00564 vendor-advisory