CVE-2026-12985: Mattermost DCR redirect URI allowlist bypass via improper URL component validation
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist via a crafted redirect URI that places an allowlisted host/path suffix inside the query string.. Mattermost Advisory ID: MMSA-2026-00700
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch MMSA-2026-00700
Event History
Frequently Asked Questions
Which deployments are exposed?
Mattermost deployments running 11.9.0 or earlier in the 11.9.x line, 11.8.4 or earlier in the 11.8.x line, or 11.7.7 or earlier in the 11.7.x line are affected. Exploitation concerns the Dynamic Client Registration OAuth feature and its configured redirect URI allowlist.
What does an attacker need to exploit this issue?
An attacker can be remote and unauthenticated, but exploitation requires user interaction. They register an OAuth client with a crafted redirect URI whose query string contains an allowlisted host or path suffix while the actual callback host is attacker-controlled.
How can teams identify potentially affected OAuth client registrations?
Review Dynamic Client Registration redirect URIs for entries where an allowlisted host or path appears only within the query string rather than as the parsed redirect URI host and path. Such registrations may have bypassed the intended allowlist validation.