CVE-2026-6334

LowCVSS 3.8/10Last modified Oct 14, 2026

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published
May 18, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-633426.3Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/CVE-2026-633439.9Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink poinCVE-2026-633497.0AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO acceptCVE-2026-63355.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allCVE-2026-633509.6Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social enCVE-2026-633516.1Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before CVE-2026-633526.1Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace pageCVE-2026-633539.6Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This CVE-2026-633549.6Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the TCVE-2026-633556.1Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on theCVE-2026-633566.1Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messaCVE-2026-633576.1Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Tr
CVE-2026-6334: Low severity, CVSS 3.8 | Vulnix