What is the CVSS score of CVE-2026-6334?

CVE-2026-6334 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6334?

Yes, a patch is available for CVE-2026-6334. Update the affected software to the latest version immediately.

Mattermost CVE-2026-6334

Q: Which versions of Mattermost are affected by CVE-2026-6334?

OAuth authorization code interception in Mattermost 10.11.x through 10.11.13 and 11.5.x through 11.5.1 allows authenticated OAuth clients to redeem authorization codes issued to different clients.. A patch is available.

EUVD-2026-30743 LOW

Authentication Bypass by Primary Weakness (CWE-305)

2026-05-18 Mattermost

GHSA-jp3f-x449-4q75

Information Disclosure Microsoft Mattermost

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:15 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570

AnalysisAI

OAuth authorization code interception in Mattermost 10.11.x through 10.11.13 and 11.5.x through 11.5.1 allows authenticated OAuth clients to redeem authorization codes issued to different clients. An attacker controlling a malicious OAuth application can intercept and exchange authorization codes meant for legitimate applications, potentially gaining unauthorized access to user data or sessions. CVSS score of 3.1 reflects high attack complexity and required privileges, with EPSS data not provided. Vendor patch released per Mattermost advisory MMSA-2026-00570.

Technical ContextAI

This vulnerability stems from improper client identity binding (CWE-305) in Mattermost's OAuth 2.0 implementation. During the authorization code flow, OAuth servers must verify that the client redeeming an authorization code is the same client to which the code was originally issued. Mattermost's token exchange endpoint failed to enforce this binding check, violating RFC 6749 security requirements. Affected product identified via CPE as Mattermost server versions 10.11.0-10.11.13 and 11.5.0-11.5.1. The flaw exists in the OAuth authorization code redemption logic, where client_id validation is insufficient or absent during the token exchange POST request, allowing cross-client code redemption attacks.

RemediationAI

Upgrade to patched Mattermost versions released per advisory MMSA-2026-00570, though exact fixed version numbers are not specified in available data-consult https://mattermost.com/security-updates for release-specific patch versions beyond 11.5.1 and 10.11.13. As an interim control, audit and restrict OAuth client application registrations to trusted first-party applications only, removing or disabling third-party OAuth integrations until patching is complete. Implement network-level monitoring to detect anomalous token exchange requests with mismatched client_id parameters compared to authorization grant logs. Review OAuth audit logs for suspicious authorization code redemptions occurring from unexpected client origins. Note that disabling OAuth entirely will break SSO and third-party integrations, requiring alternative authentication methods.