Executive brief
Mattermost, a collaboration platform for secure communication, contains a flaw in how it handles third-party application logins. An attacker with high-level access could potentially intercept and use login codes intended for a different application. This could lead to unauthorized access to user data or limited account impersonation within the platform.
Technical details
A vulnerability in the OAuth implementation of Mattermost Server arises from a failure to verify that the client requesting an access token is the same client to which the authorization code was originally issued. By submitting a crafted token exchange request, an authenticated OAuth client can redeem authorization codes intended for other clients. This is classified as an authentication bypass (CWE-305). Exploitation requires high privileges, network access, and some user interaction, with a high attack complexity. Patches have been released in versions 11.5.2, 10.11.14, and specific backported builds.
Affected products
- Mattermost Mattermost Server 11.5.0 - 11.5.1, 10.11.0 - 10.11.13, < 8.0.0-20260318173148-e9ae890a013b
Timeline
- 2026-05-18: advisory: Initial disclosure and NVD publication
- 2026-05-18: disclosed
- 2026-06-01: patched: GitHub advisory updated with reviewed status and patch details