CVE-2026-6334

LowCVSS 3.8/10Last modified Oct 14, 2026

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-305

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.5.0, <= 11.5.1; >= 10.11.0, <= 10.11.13

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: May 18, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-633417.5Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexi CVE-2026-633426.3Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/CVE-2026-633439.9Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink poin CVE-2026-633448.6Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `re CVE-2026-633458.6Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verb CVE-2026-633468.6Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].n CVE-2026-633497.0AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accept CVE-2026-63355.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have all CVE-2026-633509.6Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social en CVE-2026-633516.1Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before CVE-2026-633526.1Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page CVE-2026-633539.6Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This