---
id: CVE-2026-19541
title: Outgoing OAuth connection client secret exposure during connection validation
summary: >-
  Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10,
  11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when
  validating an outgoing OAuth connection, which allows an authenticated user
  with perm…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-201
vendor: Mattermost
product: Mattermost
affected:
  - Mattermost >= 11.9.0 <= 11.9.1
  - Mattermost >= 11.8.0 <= 11.8.5
  - Mattermost >= 11.7.0 <= 11.7.10
  - Mattermost >= 11.10.0 <= 11.10.1
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T06:54:57.403Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-19541'
references:
  - url: 'https://mattermost.com/security-updates'
    label: MMSA-2026-00761
tags:
  - cve.org
ingestedAt: '2026-10-16T08:02:23.129Z'
---

## Overview

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761

## Affected

- `Mattermost >= 11.9.0 <= 11.9.1`
- `Mattermost >= 11.8.0 <= 11.8.5`
- `Mattermost >= 11.7.0 <= 11.7.10`
- `Mattermost >= 11.10.0 <= 11.10.1`

## Remediation

Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher.