Description
Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | ≤ 2.0.37, ≤ 11.0.4, ≤ 11.1.3, ≤ 11.3.2, ≤ 10.11.11 | 2.38.0 |
Advisories 1
- WID-SEC-2026-1650 Mattermost (Desktop, Server und Mobile): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 22, 2026
References
- MMSA-2025-00564 vendor-advisory