OAuth Vulnerability in Mattermost Platform

CVE-2026-19541

What is CVE-2026-19541?

Mattermost versions 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, and 11.10.x through 11.10.1 are susceptible to a vulnerability that compromises outgoing OAuth connections. The flaw lies in the inadequate requirement for re-entering the stored client secret during the validation of an outgoing OAuth connection. This oversight allows authenticated users with permissions to manage these connections to exploit the system. By redirecting the token URL to an attacker-controlled endpoint, a malicious actor can trigger the validation process and potentially retrieve the sensitive client secret. For more details, consult the Mattermost Advisory.

References