CVE-2026-6334: OAuth authorization code client binding not enforced during token redemption in Mattermost
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6334?
CVE-2026-6334 has been assigned a medium severity rating due to its potential to allow unauthorized access during the OAuth token redemption process.
How do I fix CVE-2026-6334?
To fix CVE-2026-6334, you should update Mattermost to versions 11.5.2 or later, or 10.11.14 or later.
What versions of Mattermost are affected by CVE-2026-6334?
CVE-2026-6334 affects Mattermost versions 11.5.0 to 11.5.1 and 10.11.0 to 10.11.13.
What is the impact of CVE-2026-6334 on Mattermost users?
CVE-2026-6334 could allow an authenticated OAuth client to redeem authorization codes intended for other clients, potentially leading to unauthorized access.
Is there a workaround for CVE-2026-6334 if I cannot update right away?
There are no recommended workarounds for CVE-2026-6334, so immediate updating is the best course of action.