# Mattermost Server v5.32 > v5.36 Reflected XSS in OAuth flow

Unauthenticated reflected XSS via unsanitized redirect_to param in Mattermost OAuth mobile_login flow, letting attackers steal sessions or promote users to system_admin.

- Payout: unconfirmed
- Severity: high
- Program: Mattermost
- Credited: zi0Black
- Disclosed: 2021-07-26
- CVE: CVE-2021-37859
- Write-up quality: 7/10
- Original: https://www.shielder.it/advisories/mattermost-server-reflected-xss-oauth/
- Library page: https://bugbountylibrary.com/r/blog%3Ashielder-it-advisories-mattermost-server-reflected-xss-oauth
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:blog sev:high tech:go technique:source-review vuln:xss

**Target:** Mattermost Server OAuth mobile_login endpoint (/oauth/{service}/mobile_login)
**Root cause:** completeOAuth reads the redirect_to query param into redirectURL and passes it to RenderMobileError, which concatenates it unescaped into an <a href> in the HTML error page.
**Steps:**
1. Identify endpoint `/oauth/shielder/mobile_login` which triggers RenderMobileError when isMobile and redirect_to are set.
2. Send `GET /oauth/shielder/mobile_login?redirect_to=%22%3E%3Cimg%20src=%22%22%20onerror="..."%3E` to break out of the href attribute.
3. Inject JS in onerror that issues credentialed XHR to `/api/v4/users/<user_id>/channels/<channel_id>/posts/unread` and alerts response.
4. For admin escalation, inject XHR PUT to `/api/v4/users/<user_id>/roles` with X-CSRF-Token read from MMCSRF cookie and body `{'roles':'system_user system_admin'}`.
**How found:** Code review of web/oauth.go completeOAuth traced redirect_to into utils.RenderMobileError and RenderMobileMessage, spotting unescaped string concatenation into HTML.
**Exploitation:** Attacker crafts a link to the mobile_login OAuth endpoint with a malicious redirect_to; when a victim (or admin) visits it, the reflected payload executes in the Mattermost origin with the victim's cookies, allowing read of channel messages or, for an admin victim, promotion of the attacker's account to system_admin via the roles API using the MMCSRF token.
**Escalation:** Chained reflected XSS with CSRF-token theft to perform privileged admin API calls (role change to system_admin), and a fix bypass was later reported.
**Insight:** OAuth error-rendering paths that echo redirect_to into HTML (especially mobile-specific renderers) are frequently missed by sanitization applied only to the main web flow; check alternate render functions for raw concatenation.