CVE-2023-2193

CVE-2023-2193 describes a critical vulnerability in Mattermost where the platform fails to invalidate existing OAuth2 authorization codes upon deauthorization of an application. This flaw allows an attacker who has obtained an authorization code to generate a valid access token, even after the legitimate user has revoked the application's access. With a CVSS score of 9.1 (Critical), the vulnerability is network-exploitable with low attack complexity and no user interaction required, potentially leading to full compromise of confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.