CVE-2023-2193 — Oauth authorization codes do not expire when deauthorizing an oauth2 app
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.
Published: 2023-04-20 · CVSS: 6.5 · CVSS 3.1
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7