CVE-2026-12985

Mattermost DCR redirect URI allowlist bypass via improper URL component validation

State: Published
Severity: 6.8 Medium
Published: Sep 14, 2026
Updated: Sep 15, 2026
Reserved: Jun 23, 2026

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist via a crafted redirect URI that places an allowlisted host/path suffix inside the query string.. Mattermost Advisory ID: MMSA-2026-00700

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N	Mattermost

Weaknesses

CWE-601 URL Redirection to Untrusted Site (“Open Redirect”)

Affected Products

Product	Versions
MattermostMattermost	11.9.0 through 11.9.0Affected 11.8.0 through 11.8.4Affected 11.7.0 through 11.7.7Affected 11.10.0Not affected 11.9.1Not affected 11.8.5Not affected 11.7.8Not affected

References

MMSA-2026-00700vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.