Mattermost Mobile Apps SSO Authentication Bypass Vulnerability Allowing Credential Theft

A vulnerability exists in Mattermost Mobile Apps in versions through 2.37, 11.4, 2.0.37, 11.0.4, 11.1.3, and 11.3.2. These versions fail to properly validate the origin of SSO authentication callbacks. This flaw enables an attacker controlling a malicious Mattermost server to intercept and steal user credentials from a legitimate Mattermost server by relaying the SSO code exchange process through the mobile application.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user accounts by stealing credentials from a legitimate Mattermost server.

Remediation

Users can upgrade to Mattermost Mobile Apps version 11.7 or later to address this vulnerability.