Mattermost Authentication Bypass Vulnerability

CVE-2024-2450

What is CVE-2024-2450?

Versions of Mattermost prior to 8.1.10, 9.2.6, 9.3.2, and 9.4.3 contain a vulnerability that fails to properly verify account ownership when transitioning from email credentials to SAML authentication. This oversight enables a malicious user who is already authenticated to exploit the system and craft specific requests that could lead to the takeover of other user accounts, compromising both user privacy and system integrity.

References