CVE-2026-6334: Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow

May 18, 2026 (updated June 1, 2026)

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570

References

github.com/advisories/GHSA-jp3f-x449-4q75
github.com/mattermost/mattermost/commit/e9ae890a013bb57989fcbdb548d8b7b86b240237
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-6334

Code Behaviors & Features

Detect and mitigate CVE-2026-6334 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →