CVE-2026-19541 json
Outgoing OAuth connection client secret exposure during connection validation
published 2026-10-16 24 d ago modified 2026-10-29 10 d ago also EUVD-2026-102805
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761
Patch / fix
- Mattermost Mattermost 11.7.11, 11.8.6, 11.9.2, 11.10.2, 11.11.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 24 d ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Mattermost Mattermost
Classification
- Weakness
-
- CWE-201 Insertion of Sensitive Information Into Sent Data
References
-
mattermost.com
/security-updates
vendor-advisory
Sources
- CVE List CVE-2026-19541
- NVD CVE-2026-19541
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.