CVE-2026-19541CWE-201

CVE-2026-19541

Medium · published October 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
11.7
In the wild
Unconfirmed
What it is

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00219 · 11.7th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-10-16T11:17Z
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 16 OCT 06:54Z
    Outgoing OAuth connection client secret exposure during connection validation
    cvelistv5
  • 16 OCT 06:54Z
    Outgoing OAuth connection client secret exposure during connection validation
    cvelistv5