Threats tagged 'ghsa-h2fg-6x82-5f24'

Mattermost Mobile Apps versions up to 2.32.0 do not properly verify that Single Sign-On (SSO) redirect tokens come from a trusted server. This flaw allows a malicious Mattermost instance or an attacker positioned on the network path to capture user session credentials by crafting token-in-URL responses.