CVE-2023-1421: Mattermost Server

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.

Affected products

• Mattermost Mattermost Server: from 5.32.0, before 7.7.0 (fixed in 7.7.0)

Published 2023-03-15. Last modified 2026-06-17.