3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6334

CVE-2026-6334: Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6334

CVE-2026-6334:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260318173148-e9ae890a013b	8.0.0-20260318173148-e9ae890a013b
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260318173148-e9ae890a013b	5.3.2-0.20260318173148-e9ae890a013b

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the OAuth 2.0 implementation of Mattermost, specifically in the authorization code and refresh token grant flows. The root cause is the failure to bind the client identity during the token redemption process.

The patch e9ae890a013bb57989fcbdb548d8b7b86b240237 addresses this by adding checks in two key functions within server/channels/app/oauth.go:

handleAuthorizationCodeGrant: This function processes the authorization code grant. The patch adds a check to ensure that the clientId in the authorization data matches the clientId of the client making the request. Without this check, a malicious client could redeem an authorization code issued to another client.
handleRefreshTokenGrant: This function handles the refresh token grant. The patch introduces a check to verify that the clientId associated with the access token data (derived from the refresh token) matches the ID of the OAuth application making the request. This prevents a client from using a refresh token that was not issued to it.

These two functions are the locations of the vulnerability. An attacker could craft a request to the token endpoint, and if they are an authenticated client, they could redeem codes or refresh tokens from other clients. The runtime profile during exploitation would show calls to app.handleAuthorizationCodeGrant or app.handleRefreshTokenGrant via the main GetOAuthAccessTokenForCodeFlow function.

Vulnerable functions

app.handleAuthorizationCodeGrant

server/channels/app/oauth.go

The function `handleAuthorizationCodeGrant` is responsible for handling the OAuth 2.0 authorization code grant type. The vulnerability lies in the absence of a check to verify that the client ID from the authorization data (`authData.ClientId`) matches the client ID of the authenticated client (`clientId`). This allows an attacker to use an authorization code issued to a different client.

app.handleRefreshTokenGrant

server/channels/app/oauth.go

The function `handleRefreshTokenGrant` is responsible for handling the OAuth 2.0 refresh token grant type. The vulnerability is that it fails to validate that the client ID associated with the refresh token (`accessData.ClientId`) matches the ID of the client making the request (`oauthApp.Id`). This allows an attacker to use a refresh token belonging to a different client to obtain a new access token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.