-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from incorrect session creation logic in three key areas: 1) loginWithDesktopToken lacked OAuth/SAML validation, allowing non-SSO users to create sessions. 2) In oauth.go and saml.go, the original flow created browser sessions first before handling desktop tokens, resulting in dual sessions. The patches restructure the flow to handle desktop token redirection before session creation and add proper authentication checks. The test cases added in user_test.go confirm the fix by validating session count and authentication type flags.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20240821220019-0d6b1070a26f | 8.0.0-20240821220019-0d6b1070a26f |
Ongoing coverage of React2Shell