CVE-2026-19541: Outgoing OAuth connection client secret exposure during connection validation
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Patch MMSA-2026-00761
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have permission to manage outgoing OAuth connections. They also need to be able to modify an outgoing OAuth connection's token URL and trigger connection validation.
What is exposed if exploitation succeeds?
The stored client secret for the outgoing OAuth connection can be sent to an attacker-controlled endpoint during validation. The issue affects confidentiality only; the provided vector does not indicate integrity or availability impact.
Are all Mattermost deployments affected by default?
Exploitation depends on an outgoing OAuth connection with a stored client secret and on a user having permission to manage outgoing OAuth connections. The provided information does not establish whether such connections or permissions exist in a default deployment.
What can be done before updating?
Restrict the permission to manage outgoing OAuth connections to trusted administrators. Review and limit who can change token URLs or initiate validation for these connections.
How can administrators assess whether they may be affected?
Check whether the deployment runs Mattermost 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, or 11.10.x through 11.10.1. Also identify outgoing OAuth connections with stored client secrets and users who can manage or validate them.