Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist via a crafted redirect URI that places an allowlisted host/path suffix inside the query string.. Mattermost Advisory ID: MMSA-2026-00700

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-14T15:17:04.270Z",
  "pubdate": "2026-09-14T15:17:04.270Z",
  "executiveSummary": "Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, and 11.7.7 and earlier contain a critical vulnerability in the Dynamic Client Registration process.\nThe vulnerability involves an improper validation mechanism for OAuth client redirect URIs.\nAn unauthenticated remote attacker can bypass the established redirect URI allowlist by providing a specially crafted URI that exploits incorrect pattern matching logic.\nSuccessful exploitation allows an attacker to register an unauthorized OAuth client pointing to a malicious callback host.\nThis impacts the security of the authentication flow, potentially facilitating OAuth token theft or account takeover scenarios.\nThe risk is categorized as high due to the lack of authentication requirements for the exploitation process and the potential for intercepting sensitive authorization codes.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the redirect URI validation logic within the Dynamic Client Registration component of Mattermost.\nInstead of parsing the provided redirect URI into its constituent components (e.g., scheme, host, path, query), the application performs string-based matching using glob patterns against the raw, unfiltered URI string.\nBy manipulating the structure of the redirect URI, an attacker can append a malicious callback host while embedding a legitimate, allowlisted host or path suffix within the query string parameters of the URI.\nBecause the validation engine performs a glob-based search rather than a structured URI component comparison, it incorrectly identifies the allowlisted suffix within the query string as a successful match against the configured allowlist policy.\nThis logic flaw permits the registration of OAuth clients where the actual callback endpoint resides on an attacker-controlled server, rather than an authorized destination.\nThe attack flow proceeds as follows: First, the attacker initiates a dynamic registration request to the Mattermost OAuth provider endpoint. Second, the attacker supplies a crafted redirect URI that combines an attacker-controlled domain with a string that satisfies the application's faulty glob-matching logic. Third, the Mattermost server validates the URI and erroneously marks it as permitted, successfully registering the rogue OAuth client.\nOnce registered, the attacker can use the rogue OAuth client to initiate authentication flows. When a user authenticates via this rogue client, the Mattermost server will redirect the sensitive authorization code to the attacker-controlled callback host rather than the intended application.\nThis vulnerability is particularly severe because it is reachable by unauthenticated remote attackers, requiring no prior system privileges to execute. The exploit effectively circumvents the security boundaries intended to restrict OAuth redirects to trusted, pre-approved origins.\nThe affected versions include 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, and 11.7.x <= 11.7.7, specifically focusing on the logic responsible for handling Dynamic Client Registration."
}