An authenticated user with permission to manage outgoing OAuth connections can cause the Mattermost server to request the client secret from an arbitrary URL during connection validation. Because the server does not force re‑entry of the stored secret, the secret is exposed to the attacker‑controlled endpoint. This flaw can lead to unauthorized use of the OAuth client credentials and compromise downstream services. CWE‑201 identifies the flaw as a disclosure of information due to insufficient validation.

Mattermost Mattermost installations running any of the following versions are affected: 11.9.0‑11.9.1, 11.8.0‑11.8.5, 11.7.0‑11.7.10, and 11.10.0‑11.10.1. The vulnerability does not appear in later releases; patch versions 11.11.0 and higher contain the fix.

The flaw carries a CVSS score of 6.5, indicating moderate severity. Because the EPSS score is 0.00219, indicating a very low but non‑zero exploitation probability, and the issue is not listed in the KEV catalog, the likelihood of immediate exploitation remains uncertain. However, the vulnerability can be leveraged by any user who has permission to manage outgoing OAuth connections to obtain confidential client credentials. Once the secret is exposed, attackers could impersonate the OAuth client, enabling unauthorized access to external services that trust that client.