CVE-2026-0999
Received Received - Intake

Authentication Bypass in Mattermost via Improper Login Validation

Publication date: 2026-02-16

Last updated on: 2026-02-18

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-16
Last Modified
2026-02-18
Generated
2026-07-06
AI Q&A
2026-02-16
EPSS Evaluated
2026-07-05
NVD
CVE-2026-0999
EUVD
EUVD-2026-6102

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mattermost mattermost_server From 10.11.0 (inc) to 10.11.10 (exc)
mattermost mattermost_server From 11.2.0 (inc) to 11.2.2 (exc)
mattermost mattermost_server From 11.1.0 (inc) to 11.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-303 The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects certain versions of Mattermost (11.1.x up to 11.1.2, 10.11.x up to 10.11.9, and 11.2.x up to 11.2.1) where the software fails to properly validate login method restrictions.

Specifically, it allows an authenticated user to bypass Single Sign-On (SSO) only login requirements by using userID-based authentication.

Impact Analysis

An attacker who is already authenticated can bypass the intended SSO-only login restrictions.

This could lead to unauthorized access methods being used, potentially weakening the security posture by allowing users to authenticate in ways that were meant to be restricted.

The CVSS base score of 5.4 indicates a medium severity impact with low attack complexity and no user interaction required.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart