CVE-2026-12985: Mattermost OAuth Auth Bypass Vulnerability

CVE-2026-12985 Overview

CVE-2026-12985 is an open redirect vulnerability [CWE-601] affecting Mattermost's Dynamic Client Registration functionality. Mattermost fails to validate OAuth redirect URIs by URL component, instead matching glob patterns against the raw URI string. A remote unauthenticated attacker can register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist. The bypass works by placing an allowlisted host or path suffix inside the query string of a crafted redirect URI. The issue is tracked under Mattermost Advisory ID MMSA-2026-00700.

Critical Impact

An attacker who tricks a user into completing an OAuth flow can redirect the authorization response to an attacker-controlled host, enabling authorization code theft and account takeover.

Affected Products

• Mattermost 11.9.x versions <= 11.9.0
• Mattermost 11.8.x versions <= 11.8.4
• Mattermost 11.7.x versions <= 11.7.7

Discovery Timeline

• 2026-09-14 - CVE-2026-12985 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-12985

Vulnerability Analysis

The vulnerability resides in Mattermost's Dynamic Client Registration handler for OAuth 2.0 clients. When a client registers a redirect URI, the server compares the submitted URI against an allowlist using glob-style pattern matching on the raw string. Proper OAuth implementations require parsing the URI and validating individual components such as scheme, host, and path.

Because validation operates on the raw string, an allowlisted token can appear anywhere in the URI, including the query component. An attacker crafts a URI whose actual host points to attacker infrastructure while embedding the allowlisted host or path suffix in the query string to satisfy the glob pattern.

Successful exploitation lets the attacker complete a valid OAuth authorization flow with authorization codes delivered to their own callback endpoint. This enables interception of tokens, session hijacking, and downstream account compromise if the target user is convinced to initiate the flow.

Root Cause

The root cause is improper URL validation classified under [CWE-601] Open Redirect. The server treats the redirect URI as an opaque string during allowlist comparison rather than a structured URL. Glob patterns intended to constrain host and path can be satisfied by content outside the authority component.

Attack Vector

The attack requires network access to the Mattermost Dynamic Client Registration endpoint and user interaction to complete the OAuth consent flow. No prior authentication is required for the attacker to register a malicious client. The attacker registers a redirect URI where the host resolves to attacker-controlled infrastructure but the query string contains the allowlisted suffix.

The vulnerability mechanism is described in prose only. See the Mattermost Security Updates advisory for additional technical detail.

Detection Methods for CVE-2026-12985

Indicators of Compromise

• Dynamic Client Registration requests containing redirect URIs where the host does not match expected allowlisted values but the query string contains allowlisted host or path fragments.
• OAuth authorization codes issued to clients whose registered redirect URI resolves to external or unfamiliar domains.
• New OAuth client registrations from unauthenticated sources shortly before user-initiated authorization flows.

Detection Strategies

• Parse redirect URIs from OAuth client registration logs and compare the parsed host and scheme against the configured allowlist independently of raw-string matching.
• Alert on OAuth authorization responses where the callback host differs from historically observed hosts for the same tenant.
• Correlate Dynamic Client Registration events with subsequent authorization code exchanges from unusual IP addresses or ASNs.

Monitoring Recommendations

• Enable verbose logging on the Mattermost OAuth server and forward events to a SIEM for retention and analysis.
• Baseline the set of registered OAuth clients and monitor for new registrations, especially those created without administrator involvement.
• Track user consent events and flag flows terminating at newly registered clients with atypical redirect URIs.

How to Mitigate CVE-2026-12985

Immediate Actions Required

• Upgrade Mattermost to a fixed release above 11.9.0, 11.8.4, or 11.7.7 per the vendor advisory.
• Audit existing OAuth client registrations and remove any client with a redirect URI that does not match the intended host after URL parsing.
• Restrict access to the Dynamic Client Registration endpoint to authenticated administrators where deployment supports it.

Patch Information

Mattermost has published fixes under advisory MMSA-2026-00700. Review the Mattermost Security Updates page for the specific patched versions and upgrade guidance for the 11.7.x, 11.8.x, and 11.9.x branches.

Workarounds

• Disable Dynamic Client Registration if the feature is not required in the deployment.
• Front the Mattermost server with a reverse proxy or web application firewall that validates OAuth registration payloads and rejects redirect URIs whose parsed host is not on an explicit allowlist.
• Require administrator review before any OAuth client is activated for user authorization flows.

# Example: block registration requests whose parsed redirect_uri host is off-allowlist
# (reverse proxy pseudocode - adapt to your WAF/proxy syntax)
if ($request_uri ~* "/oauth/register") {
    # Enforce that redirect_uri host component matches allowlist
    # Do NOT rely on substring or glob matches over the raw URI
    deny_if_host_not_in_allowlist $arg_redirect_uri;
}