Executive brief
Mattermost's Dynamic Client Registration feature failed to properly validate redirect URIs, allowing unauthenticated attackers to register malicious OAuth clients with attacker-controlled callback hosts. This bypasses the configured allowlist and could enable phishing attacks or credential theft via OAuth token interception.
Technical details
The vulnerability exists in Mattermost's Dynamic Client Registration implementation, which validates redirect URIs using glob pattern matching against the raw URI string rather than parsing individual URL components. An attacker can craft a malicious redirect URI that places an allowlisted host or path as a suffix in the query string parameter, causing the validation check to pass while the actual callback destination remains attacker-controlled. This is a classic URL parsing confusion attack where naive string matching fails to properly distinguish between the URL path and query parameters. The vulnerability requires no authentication and is remotely exploitable via network access to the OAuth registration endpoint.
Affected products
- Mattermost Mattermost Server 11.7.x through 11.7.7, 11.8.x through 11.8.4, 11.9.x through 11.9.0
Timeline
- 2026-09-14: disclosed