https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:50:26.717311+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-319257 EUVD-2026-319257 2026-10-06T10:50:26.777863+00:00 EUVD-2026-319257 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6334 fkie_cve-2026-6334 2026-10-06T10:50:26.777904+00:00

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570

 https://cve.radiocsirt.org/vuln/ghsa-jp3f-x449-4q75 GHSA-jp3f-x449-4q75 — Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow 2026-10-06T10:50:26.777939+00:00

Affected: Go: github.com/mattermost/mattermost/server/v8, Go: github.com/mattermost/mattermost-server

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570