CVE-2026-19541
Last modified
CVE-2026-19541 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost Server | >= 11.7.0, < 11.7.11 |
| Mattermost | Mattermost Server | >= 11.8.0, < 11.8.6 |
| Mattermost | Mattermost Server | >= 11.9.0, < 11.9.2 |
| Mattermost | Mattermost Server | >= 11.10.0, < 11.10.2 |
References
- https://mattermost.com/security-updatesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-19541?
How severe is CVE-2026-19541?
How do I fix CVE-2026-19541?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1953Nukegraphic CMS v3.1.2 contains a stored cross-site scriptin…8.2
- CVE-2026-19532Improper Limitation of a Pathname to a Restricted Directory …5.3
- CVE-2026-19534undici's WebSocket client crashes the whole Node.js process …7.5
- CVE-2026-19535Nozomi Networks Labs identified a CWE-352: Cross-Site Reques…8.6
- CVE-2026-19538The BLOCKED access control list items that are evaluated to …7.5
- CVE-2026-19539Authorization Bypass Through User-Controlled Key in the tick…8.6
- CVE-2026-19542Calling tdelete on a sufficiently deep tree in the GNU C Lib…5.6
- CVE-2026-19543IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…6.2
- CVE-2026-19546A flaw was found in DBI. This is a fix for a partial fix for…8.8
- CVE-2026-19547Ghostscript for Windows is vulnerable to local privilege esc…7
- CVE-2026-19548Multiple Use-After-Free vulnerabilities were found in the ad…5.5
- CVE-2026-19550A flaw was found in FreeIPA. The trust-fetch-domains command…8.2
Are you affected by CVE-2026-19541?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST