CVE-2026-3471

The record

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618

Affected packages

Related vulnerabilities

• CVE-2026-73335 Android application "Myna Point" is vulnerable to Improper Authorization in Handler for… CWE-939
• CVE-2026-21075 Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3… CWE-939
• CVE-2026-21062 Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local… CWE-939
• CVE-2026-59717 Home Assistant is open source home automation software focused on local control and… CWE-939
• CVE-2026-12189 A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. CWE-939
• CVE-2026-12190 A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. CWE-939
• CVE-2026-53408 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version… CWE-939
• CVE-2026-53407 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version… CWE-939