CVE-2026-12985 is a medium severity flaw (CVSS 6.8) in Mattermost Server. Dynamic Client Registration checked redirect URIs with glob patterns on the raw string, so an attacker could register an OAuth client with a callback host outside the allowlist. Upgrade to the fixed release listed in Mattermost advisory MMSA-2026-00700.
What's affected
The record lists these Mattermost Server versions as affected:
- 11.9.x up to and including 11.9.0
- 11.8.x up to and including 11.8.4
- 11.7.x up to and including 11.7.7
The record does not name the fixed versions. The Mattermost security updates page was the only reference and its table did not load for us, so read advisory MMSA-2026-00700 there for the exact fixed release on your branch. Mattermost says it has a mandatory upgrade policy and ships fixes for supported releases.
In short, if you run a 11.7, 11.8 or 11.9 server and your version number is at or below the last number in its range, plan an upgrade. Servers on older branches than 11.7 are not described in the record, so do not assume they are safe. Mattermost says it supports specific releases, so an unsupported branch is a reason to move to a supported one.
How to check if you're exposed
Find your server version in the System Console under About, or run the version command on the server host:
./mattermost version
Then see whether Dynamic Client Registration is in use. If you never enabled OAuth apps or dynamic registration, your exposure is smaller, but the advisory is the place to confirm that for your build. Compare the version with the three ranges above.
It also helps to list the OAuth apps registered on the server. Look for clients you did not create, and look at the callback URLs they use. A legitimate client points to a host you know. A callback that points to an unfamiliar domain, or one whose query string contains another address, deserves a closer look.
What to do now
- Open the Mattermost security updates page and find MMSA-2026-00700 to get the fixed release for your branch.
- Plan the upgrade to that release or a later one.
- Until you upgrade, review which OAuth clients exist and remove any you do not recognize.
- If you do not need Dynamic Client Registration, check whether it can be turned off in your configuration and follow the advisory guidance.
- Scan your own dependency files in the free in-browser scan so the rest of your stack is not a blind spot.
- Keep a record of the server version before and after the upgrade, so you can show the fix was applied.
Why it matters
OAuth relies on a redirect URI allowlist to make sure authorization codes and tokens go only to places the operator approved. Here the match was done against the raw URI string. A crafted URI can put an allowlisted host and path inside the query string while the real host is something else, so the pattern matches and the check passes.
The fix class is to parse the URI and compare each component, scheme, host, port and path, instead of matching one string. The record rates it as needing user interaction and higher attack complexity, which is why the score is medium. The impact ratings for confidentiality and integrity are still high, because a stolen authorization grant acts as the user. The record does not flag this CVE as known exploited.
For defenders the lesson is to compare parsed parts of a URL, never a glob over the raw text. Allowlists for OAuth are worth testing with deliberately odd inputs in a test environment, such as a second address placed in a query string.
The record lists this weakness class: CWE-601 (URL Redirection to Untrusted Site (Open Redirect)).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need a login to the Mattermost server?
The record describes the attacker as remote and unauthenticated for the client registration step. A user still has to take part in the flow, which is why the vector shows user interaction as required.
What would a safe redirect check look like?
Parse the URI, then compare scheme, host, port and path exactly against what was registered. Matching a pattern against the raw string is the approach the record describes as the cause.
Is a fixed version listed in the record?
No. The record names only the affected versions and the advisory ID MMSA-2026-00700, so read that advisory for the fix on your branch.
Sources
Last reviewed: 19 October 2026.
