CVE-2026-22880: Mattermost Mobile SSO Auth Bypass Flaw

CVE-2026-22880 Overview

CVE-2026-22880 is a Single Sign-On (SSO) callback origin validation flaw affecting Mattermost Mobile Apps. The vulnerability is tracked under Mattermost Advisory ID MMSA-2025-00564 and is categorized under [CWE-352] Cross-Site Request Forgery.

Affected versions include Mattermost Mobile Apps <=2.37, 11.4, 2.0.37, 11.0.4, 11.1.3, 11.3.2, and 10.11.11.0. The mobile application fails to properly validate the origin of the SSO authentication callback. An attacker operating a malicious Mattermost server can relay the SSO code exchange flow through the mobile application to steal user credentials intended for a legitimate Mattermost server.

Critical Impact

An attacker controlling a malicious Mattermost server can capture authentication credentials issued for a legitimate Mattermost server through SSO flow relaying.

Affected Products

• Mattermost Mobile Apps versions <=2.37
• Mattermost Mobile Apps versions 11.0.4, 11.1.3, 11.3.2, 11.4
• Mattermost Mobile Apps versions 2.0.37, 10.11.11.0

Discovery Timeline

• 2026-05-21 - CVE-2026-22880 published to NVD
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-22880

Vulnerability Analysis

The vulnerability resides in how Mattermost Mobile Apps process SSO authentication callbacks. The application does not verify that the origin of the callback matches the server that initiated the authentication request. This omission permits a malicious Mattermost server to interpose itself between the user and the legitimate identity provider flow.

When a user attempts to authenticate against a malicious server, that server can redirect the mobile client into an SSO code exchange aimed at a legitimate Mattermost deployment. The mobile application then completes the exchange and returns the resulting authentication artifact through the attacker-controlled origin. The flaw is classified as Cross-Site Request Forgery [CWE-352] because the mobile client honors a state-changing authentication action without confirming the legitimacy of the requesting origin.

Root Cause

The root cause is missing validation of the SSO callback origin within the mobile application. The client trusts that any inbound SSO callback corresponds to the server that began the flow. Without binding the callback to the originating server, the application cannot distinguish a legitimate exchange from one relayed by an attacker.

Attack Vector

Exploitation requires user interaction. The attacker must convince a user to initiate authentication against an attacker-controlled Mattermost server. Once the user begins SSO from the mobile app, the malicious server relays the code exchange to a legitimate Mattermost server. The mobile client completes authentication, and the attacker captures the credentials issued by the legitimate server.

The vulnerability mechanism is described in prose because no verified proof-of-concept code is available. Refer to the Mattermost Security Updates advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-22880

Indicators of Compromise

• Authentication sessions on legitimate Mattermost servers originating from mobile clients shortly after the client interacted with an unrecognized Mattermost host.
• SSO callback redirects whose origin domain does not match the Mattermost server URL the user initially selected.
• Unexpected mobile-initiated logins from geographic locations or IP ranges inconsistent with the user baseline.

Detection Strategies

• Inspect Mattermost server audit logs for SSO code exchanges that were issued to mobile clients but completed from unfamiliar referrers.
• Correlate identity provider authentication events with the destination Mattermost server URL to surface mismatches.
• Alert on mobile devices configured with multiple, rapidly switching Mattermost server endpoints.

Monitoring Recommendations

• Enable verbose SSO and authentication logging on both the identity provider and the Mattermost server.
• Monitor mobile device management (MDM) inventories for Mattermost Mobile App versions listed as affected.
• Track unusual session establishment patterns following user reports of being redirected to unfamiliar Mattermost instances.

How to Mitigate CVE-2026-22880

Immediate Actions Required

• Upgrade Mattermost Mobile Apps to a fixed version as documented in the Mattermost security advisory.
• Instruct users to authenticate only against trusted Mattermost server URLs and to avoid joining unknown servers from the mobile client.
• Audit recent SSO authentication events for signs of relayed code exchanges.

Patch Information

Mattermost has released security updates referenced under advisory MMSA-2025-00564. Consult the Mattermost Security Updates page for fixed version details and update instructions.

Workarounds

• Restrict mobile users to a defined list of approved Mattermost server URLs through MDM configuration.
• Educate users on the social engineering vector that requires initiating SSO against an attacker-controlled server.
• Where feasible, enforce additional multi-factor verification at the identity provider to limit the value of stolen authentication codes.