Account Takeover via Substring Matching in OpenID Connect Authentication
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow.. Mattermost Advisory ID: MMSA-2026-00590
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-303 | CWE-303: Incorrect Implementation of Authentication Algorithm |
Type: CWE
Description: CWE-303: Incorrect Implementation of Authentication Algorithm
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 5.7 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N |
Version: 3.1
Base score: 5.7
Base severity: MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N