CVE-2026-3590

Received Received - Intake

Magic Link Token Replay Vulnerability in Mattermost Authentication

Publication date: 2026-04-15

Last updated on: 2026-04-22

Assigner: Mattermost, Inc.

Description

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent requests.. Mattermost Advisory ID: MMSA-2026-00624

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-15

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-15

EPSS Evaluated

2026-07-05

NVD

CVE-2026-3590

EUVD

EUVD-2026-22915

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	From 10.11.0 (inc) to 10.11.13 (exc)
mattermost	mattermost_server	From 11.3.0 (inc) to 11.3.3 (exc)
mattermost	mattermost_server	From 11.4.0 (inc) to 11.4.3 (exc)
mattermost	mattermost_server	From 11.5.0 (inc) to 11.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Impact Analysis

The vulnerability allows an attacker to reuse a single valid guest magic link multiple times to create multiple authenticated sessions.

This can lead to unauthorized access and potential misuse of guest accounts, increasing the risk of data exposure or unauthorized actions within the Mattermost environment.

Executive Summary

This vulnerability exists in certain versions of Mattermost where the system fails to enforce atomic single-use consumption of guest magic link tokens.

Because of this failure, an attacker who has access to a valid magic link can use it multiple times concurrently to establish multiple independent authenticated sessions.

Hi! I’m here to help you understand CVE-2026-3590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70