Improper URL Validation in Mattermost by Mattermost

CVE-2026-12985

What is CVE-2026-12985?

Mattermost versions 11.9.x up to 11.9.0, 11.8.x up to 11.8.4, and 11.7.x up to 11.7.7 are susceptible to an improper validation vulnerability. The application fails to appropriately validate Dynamic Client Registration redirect URIs. As a result, a remote attacker can exploit this oversight to register an OAuth client with a callback host under their control. This means that the attacker can bypass the configured redirect URI allowlist by crafting a redirect URI that includes a permitted host or path suffix within the query string, leading to potential unauthorized access and harmful outcomes. For more details, refer to the official advisory from Mattermost.

References