{"id":"EUVD-2026-30743","enisaUuid":"6ff319f2-6551-3199-83d0-c7b608e5347a","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570","datePublished":"May 18, 2026, 6:33:56 AM","dateUpdated":"May 18, 2026, 2:36:36 PM","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-6334\nGHSA-jp3f-x449-4q75\n","assigner":"Mattermost","epss":0.12,"enisaIdProduct":[{"id":"53c90463-13f9-3508-8680-fe0716c91515","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"},{"id":"a4750ee6-34a6-3454-8f8e-402253412526","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"}],"enisaIdVendor":[{"id":"7f2e10b2-f70f-3571-b562-a304f41c980d","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"1a215e7e-8673-30af-abf3-199af5d137ee","vulnerability":{"id":"GHSA-jp3f-x449-4q75","description":"Mattermost doesn\u0027t enforce client identity binding during the OAuth authorization code redemption flow","datePublished":"May 18, 2026, 9:31:47 AM","dateUpdated":"Jun 1, 2026, 3:04:49 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-6334\nhttps://github.com/mattermost/mattermost/commit/e9ae890a013bb57989fcbdb548d8b7b86b240237\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30743\n","aliases":"CVE-2026-6334\nGHSA-jp3f-x449-4q75\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"2a468a24-4f10-30f3-8fa7-27d9b15362e2","vulnerability":{"id":"CVE-2026-6334","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1, 10.11.x \u003c\u003d 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570","datePublished":"May 18, 2026, 6:33:56 AM","dateUpdated":"May 18, 2026, 2:36:36 PM","status":"PUBLISHED","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30743\n","assigner":"Mattermost","epss":0.12,"dataProcessed":"Nov 5, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"84449db7-047e-3138-8a89-fd2907620f25","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.13"},{"id":"ea91712c-b512-3da1-9e2e-588a5df4a875","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"}],"vulnerabilityVendor":[{"id":"b129e7ae-abef-3233-8453-99a6057c6285","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}