Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-19541

Outgoing OAuth connection client secret exposure during connection validation

Medium6.5EPSS 0.22%
Published
Updated
Reserved
Assigned by
Mattermost

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761

Timeline

  1. ID reserved

    By Mattermost

  2. · 2 months later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-19541, by who scored it
Scored byCVSSScoreVector
MattermostCNA (assigner)3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Analyzed3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.22% · top 87% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

  • Mattermost · Mattermost

    • affected 11.9.0 – ≤ 11.9.1
    • affected 11.8.0 – ≤ 11.8.5
    • affected 11.7.0 – ≤ 11.7.10
    • affected 11.10.0 – ≤ 11.10.1
    • unaffected 11.11.0
    • unaffected 11.9.2
    • unaffected 11.8.6
    • unaffected 11.7.11
    • unaffected 11.10.2

What to do

Solution: Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-19541 badge
[![CVE-2026-19541](https://trackcve.app/badge/CVE-2026-19541.svg)](https://trackcve.app/cve/CVE-2026-19541)

Record last updated .