OAuth Application Session Vulnerability in Mattermost by Mattermost
CVE-2026-19076

4.4MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
16 October 2026

What is CVE-2026-19076?

Certain Mattermost versions are susceptible to an OAuth session takeover due to inadequate session rejection in the account type switch endpoint. If an attacker possesses a valid OAuth bearer token for a targeted user, they can exploit this flaw to permanently assume control of the user's account linked with single sign-on (SSO). By issuing a crafted request to switch accounts, the attacker can set a new password and detach the user's account from its identity provider, leading to unauthorized access and potential account compromise.

Affected Version(s)

Mattermost 11.10.0

Mattermost 11.7.0 <= 11.7.9

Mattermost 11.9.0 <= 11.9.1

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CERT PL
.