Live › vulnerability › CVE-2026-19541
Go to dashboardMattermost fails to require re-entry of the stored client secret when validating an outgoing OAuth connection. An authenticated user who can manage outgoing OAuth connections can point the token URL at an endpoint they control, trigger validation, and receive the stored secret.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Mattermost servers in the listed affected version ranges are exposed. The attacker needs an account with permission to manage outgoing OAuth connections, so servers where only trusted admins hold that permission carry less risk. Managed or cloud Mattermost instances are handled by the vendor, and servers already on a fixed release can skip this.
No product ranges from the sources yet.
mattermost version, and compare it against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761
This page as .md · .json · in your agent: get_signal("CVE-2026-19541")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.