Description
Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
0 to ≤ 2.0.37affected0 to ≤ 11.0.4affected0 to ≤ 11.1.3affected0 to ≤ 11.3.2affected0 to ≤ 10.11.11affected2.38.0unaffected11.5.0unaffected2.37.1.0unaffected11.4.1unaffected11.3.2unaffected11.2.4unaffected10.11.12unaffected