{"id":"EUVD-2026-30743","revision":"7703fc1667ae4c59aa2c1f8d67f227c2","records":[{"revision":"7703fc1667ae4c59aa2c1f8d67f227c2","observedAt":"2026-10-30T10:55:51.996+00:00","statement":{"source":"euvd","id":"EUVD-2026-30743","aliases":["CVE-2026-6334","GHSA-jp3f-x449-4q75"],"title":"Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a diffe…","description":"Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","score":3.1,"severity":null}],"references":["https://mattermost.com/security-updates"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30743","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 18, 2026, 6:33:56 AM","dateUpdated":"May 18, 2026, 2:36:36 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30743","identifiers":["EUVD-2026-30743","CVE-2026-6334","GHSA-jp3f-x449-4q75"]},"retained":false,"historicalAffected":[]}],"coverage":[]}