CVE-2026-0999 — Authentication bypass via userID login when email and username login are disabled
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-o…
Published: 2026-02-16 · CVSS: 5.4 · CVSS 3.1
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7