Description
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | ≤ 7.1.7, ≤ 7.7.3, ≤ 7.8.2, ≤ 7.9.1 | 7.10 |
Advisories 1
- WID-SEC-2023-1056 Mattermost: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Apr 20, 2023