Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 14:36:44 +0000 CVE-2026-22880 — Mobile SSO authentication flow allows credential theft via malicious server https://vulnerability.circl.lu/vuln/cve-2026-22880 <p><strong>Affected:</strong> Mattermost</p> <p>Mattermost Mobile Apps versions &lt;=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564</p> <p><strong>Affected:</strong> Mattermost</p> <p>Mattermost Mobile Apps versions &lt;=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564</p> https://vulnerability.circl.lu/vuln/cve-2026-22880