Juho Forsén

Open redirect in OAuth login

AI plugin APIs can be triggered using post actions

Thread summarization allows persistent access to channel

LDAP Injection in Mattermost Enterprise Edition When Using Active Directory

Unauthorized AI bot activation via Wrangler plugin

Data exfiltration via AI plugin Jira tool

Webhook Secret Exposure via Timing attack in MSteams plugin

Munged email address used for password resets and notifications

Email addresses of remote users visible in props regardless of server settings

Permanently local data deletion by malicious remote