CVE-2026-22880 — Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4

title: Mattermost Mobile App SSO Callback Origin Validation Bypass (CVE-2026-22880) - Free Tier
id: scw-2026-05-21-ai-1
status: experimental
level: medium
description: |
  Detects requests to the Mattermost authorization endpoint that include common OAuth parameters, potentially indicating an attempt to exploit CVE-2026-22880. This vulnerability allows an attacker controlling a malicious Mattermost server to steal user credentials by relaying the SSO code exchange flow through a vulnerable mobile application. This rule focuses on the initial callback phase of the SSO flow.
author: SCW Feed Engine (AI-generated)
date: 2026-05-21
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-22880/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/oauth/authorize'
      cs-uri|contains:
          - 'redirect_uri='
      cs-uri|contains:
          - 'response_type=code'
      cs-uri|contains:
          - 'client_id='
      cs-uri|contains:
          - 'state='
      cs-uri|contains:
          - 'scope='
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse