CVE-2026-6334CWE-305

CVE-2026-6334

Low · published May 18, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00118 · 1.6th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2026-05-18T12:16Z
Affected products (2)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.11.0, < 10.11.1410.11.14
mattermost/mattermost_server≥ 11.5.0, < 11.5.211.5.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 18 MAY 06:33Z
    OAuth authorization code client binding not enforced during token redemption in Mattermost
    cvelistv5