Aryangurjarf401A3

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.9.0 Mattermost versions 11.8.0 through 11.8.4 Mattermost versions 11.7.0 through 11.7.7 **Description** An issue exists where the software fails to validate Dynamic Client Registration redirect URIs by URL component, instead matching glob patterns against the raw URI string. This allows a remote unauthenticated attacker to register an OAuth client with a callback host under their control. The attacker can bypass the configured redirect URI allowlist by using a crafted redirect URI that places an allowlisted host or path suffix within the query string. **Recommendations** Update Mattermost version 11.9.0 to a newer version. Update Mattermost versions 11.8.0 through 11.8.4 to a newer version. Update Mattermost versions 11.7.0 through 11.7.7 to a newer version.