The vulnerability arises when Mattermost fails to enforce the binding between an OAuth client and the authorization code issued during the OAuth redemption flow. An authenticated OAuth client can craft a token exchange request and redeem an authorization code that was issued to a different client. This flaw allows an attacker possessing credentials for one OAuth client to obtain access tokens for another, potentially exposing resources to which the attacker should not have access. The weakness originates from improper validation of client identity, as identified by CWE-305.

Mattermost Mattermost versions 10.11.0 through 10.11.13 and 11.5.0 through 11.5.1 are affected.

The CVSS score of 3.1 indicates a low severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to already be an authenticated OAuth client; unauthenticated users cannot leverage this flaw. If an attacker gains access to an OAuth client, they could potentially misuse authorization codes intended for other clients to access protected resources, but overall risk to the system remains limited under the current assessment.