CVE-2026-6334 Overview
CVE-2026-6334 affects Mattermost versions 11.5.x up to and including 11.5.1, and versions 10.11.x up to and including 10.11.13. The vulnerability stems from failure to enforce client identity binding during the OAuth authorization code redemption flow. An authenticated OAuth client can redeem authorization codes issued to a different client through a crafted token exchange request. Mattermost tracks this issue under advisory MMSA-2026-00570. The flaw maps to [CWE-305] Authentication Bypass by Primary Weakness and requires high attacker privileges, user interaction, and high attack complexity to exploit.
Critical Impact
An authenticated OAuth client can exchange authorization codes belonging to another client, leading to limited confidentiality and integrity loss across affected Mattermost deployments.
Affected Products
- Mattermost Server versions 11.5.0 through 11.5.1
- Mattermost Server versions 10.11.0 through 10.11.13
- Deployments exposing the OAuth 2.0 authorization endpoint to third-party clients
Discovery Timeline
- 2026-05-18 - CVE-2026-6334 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-6334
Vulnerability Analysis
The vulnerability resides in Mattermost's OAuth 2.0 authorization code exchange logic. RFC 6749 requires the authorization server to verify that the client_id presented during token redemption matches the client the authorization code was issued to. Mattermost's implementation omits this binding check. An authenticated OAuth client can therefore submit a token exchange request referencing an authorization code that was originally issued to a different registered client. The server accepts the redemption and issues access tokens, breaking the trust boundary between distinct OAuth clients. The flaw is classified under [CWE-305] because the primary authentication step, client identity verification at the token endpoint, is bypassed.
Root Cause
The root cause is missing validation between the authorization code record and the credentials of the client presenting it. The token endpoint validates the code's existence and expiration but does not compare the bound client_id against the authenticated requester. This logic gap allows cross-client code redemption when the attacker controls a valid registered OAuth client and can observe or intercept an authorization code intended for a different client.
Attack Vector
Exploitation requires the attacker to operate a registered OAuth client on the target Mattermost instance and obtain an authorization code issued to a separate client. The attacker submits a POST request to the /oauth/access_token endpoint with the captured code, their own client_id, and client_secret. User interaction is required because the original authorization code is generated through a user-driven consent flow. The high attack complexity reflects the prerequisite of capturing or intercepting a code intended for another client. See the Mattermost Security Updates advisory for technical details specific to the token exchange handler.
Detection Methods for CVE-2026-6334
Indicators of Compromise
- Successful POST requests to /oauth/access_token where the client_id parameter differs from the client the authorization code was originally issued to
- OAuth access token issuance events for clients that did not initiate the corresponding authorization request
- Mattermost audit log entries showing access token grants without a matching authorization request from the same client
Detection Strategies
- Correlate authorization code issuance records with token redemption events and flag mismatches between issuing and redeeming client_id values
- Monitor for OAuth clients redeeming codes within unusually short windows after issuance to a different client
- Alert on registered OAuth clients exhibiting a sudden increase in successful token exchanges relative to their initiated authorization flows
Monitoring Recommendations
- Forward Mattermost application and audit logs to a centralized analytics platform for cross-referencing OAuth events
- Track baseline token issuance volumes per registered OAuth client to detect anomalies
- Review the inventory of registered OAuth applications and disable clients that are unused or unverified
How to Mitigate CVE-2026-6334
Immediate Actions Required
- Upgrade Mattermost Server to a release that addresses MMSA-2026-00570 as listed on the Mattermost Security Updates page
- Audit all registered OAuth applications and revoke any that are no longer required or whose ownership cannot be verified
- Rotate OAuth client secrets for applications integrated with affected Mattermost instances
Patch Information
Mattermost has published remediation guidance under advisory MMSA-2026-00570. Administrators should consult the Mattermost Security Updates portal to identify the fixed release corresponding to their deployment branch and apply it. Fixed builds enforce client identity binding during authorization code redemption so that the client_id presented at the token endpoint must match the client recorded with the code.
Workarounds
- Restrict OAuth client registration to administrators and require manual approval for new clients
- Limit the scopes granted to OAuth clients to reduce the impact of cross-client code redemption
- Where feasible, disable third-party OAuth integrations until the patched version is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
