PT-2026-41644 · Mattermost · Mattermost

Dylan Haussermann · CVE-2026-6334 · Published 2026-05-18 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13

Description An issue exists in the OAuth authorization code redemption flow where client identity binding is not enforced. This allows an authenticated OAuth client to redeem authorization codes issued to a different client by using a crafted token exchange request.

Recommendations Update versions 11.5.0 through 11.5.1 to a version later than 11.5.1. Update versions 10.11.0 through 10.11.13 to a version later than 10.11.13.

Exploit

Fix

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2026-6334

GHSA-JP3F-X449-4Q75

GO-2026-5474

Affected Products

Mattermost

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6334.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6334 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5474 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-6334 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jp3f-x449-4q75 · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/e9ae890a013bb57989fcbdb548d8b7b86b240237 · Note
• https://github.com/mattermost/mattermost · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6334 · Note
• https://t.me/CVEtracker/54105 · Telegram Post
• https://github.com/advisories/GHSA-jp3f-x449-4q75 · Note