Go/github.com/mattermost/mattermost/server/v8 CVE-2026-6334: low 3.8, EPSS 0.12%

Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20260318173148-e9ae890a013b or later.

go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260318173148-e9ae890a013b

Affected

Fixed versions

Sources

• osv: GO-2026-5474#Go/github.com/mattermost/mattermost/server/v8
• nvd: CVE-2026-6334
• https://github.com/advisories/GHSA-jp3f-x449-4q75
• https://github.com/mattermost/mattermost/commit/e9ae890a013bb57989fcbdb548d8b7b86b240237
• https://mattermost.com/security-updates

CVE-2026-6334 · published 2026-06-25T22:34:31Z · modified 2026-06-25T23:00:17.667622181Z · JSON