---
id: "CVE-2026-19541"
kind: "vulnerability"
aliases: ["CVE-2026-19541"]
title: "Mattermost: outgoing OAuth validation leaks stored client secret to attackers"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mattermost", "oauth", "package", "self-hosted"]
not_affected_if: ["auth-required", "default-config", "managed-hosting"]
published_at: "2026-10-16T07:17:12+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:57:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19541", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Mattermost: outgoing OAuth validation leaks stored client secret to attackers

Mattermost fails to require re-entry of the stored client secret when validating an outgoing OAuth connection. An authenticated user who can manage outgoing OAuth connections can point the token URL at an endpoint they control, trigger validation, and receive the stored secret.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Mattermost server version in the System Console or with `mattermost version`, and compare it against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.
- Review who holds the permission to manage outgoing OAuth connections in the System Console.

## Fix

- Upgrade Mattermost to a fixed release for your branch (the sources list the affected ranges; check the MMSA-2026-00761 advisory for the exact fixed versions, which the sources do not state).
- Rotate the client secrets stored in outgoing OAuth connections if untrusted users had permission to manage them.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19541

## From the sources

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_