CVE-2026-0999: 
vulnerability analysis and mitigation

CVE-2026-0999 is an authentication bypass vulnerability in Mattermost Server that allows authenticated users to circumvent SSO-only login restrictions by using userID-based authentication instead. It affects Mattermost Server versions 10.11.0–10.11.9, 11.1.0–11.1.2, and 11.2.0–11.2.1. The vulnerability was published on February 16, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 4.3 (Medium) (Mattermost Security, Red Hat CVE).

The root cause is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm), where Mattermost Server fails to properly validate login method restrictions. An authenticated user can bypass enforced SSO-only login policies by directly invoking userID-based authentication endpoints, effectively circumventing the intended access control mechanism. The attack vector is network-based, requires low privileges (an existing authenticated session or credentials), and no user interaction. The associated CAPEC pattern is CAPEC-90 (Reflection Attack in Authentication Protocol) (Mattermost Security, Red Hat CVE).

Successful exploitation allows an authenticated user to bypass organizational SSO enforcement policies and authenticate via userID-based methods that should be restricted. The primary impact is low integrity compromise — users can access Mattermost instances in ways that violate security policy — with no direct confidentiality or availability impact. While the individual impact is limited, this bypass could undermine identity governance controls, particularly in environments relying on SSO for centralized access management and audit logging (Mattermost Security).

1. Identify target: Confirm the Mattermost Server instance is running a vulnerable version (10.11.0–10.11.9, 11.1.0–11.1.2, or 11.2.0–11.2.1) and has SSO-only login enforced in its configuration.
2. Obtain credentials: Acquire valid user credentials (e.g., username/password) for an account on the target instance — this may be through phishing, credential stuffing, or insider access.
3. Bypass SSO enforcement: Instead of authenticating through the configured SSO provider, send a direct authentication request to the Mattermost API using userID-based authentication (e.g., via the /api/v4/users/login endpoint with email/password or userID parameters).
4. Achieve unauthorized session: The server, due to improper validation of login method restrictions, grants a valid session token without enforcing the SSO requirement, allowing the attacker to operate as a legitimate user outside the expected SSO audit trail (Mattermost Security).

• Logs: Mattermost server logs showing successful /api/v4/users/login authentication events using password-based or userID-based methods for accounts that should only authenticate via SSO; absence of corresponding SSO provider authentication events for the same user sessions.
• Network: API calls to Mattermost login endpoints originating from unexpected IP addresses or clients not associated with the SSO identity provider flow.
• Application: User sessions active without a corresponding SSO token or SAML/OAuth assertion in authentication audit logs; discrepancies between Mattermost session records and SSO provider session logs.

Mattermost has released patched versions addressing this vulnerability: update to 10.11.10 or later, 11.1.3 or later, or 11.2.2 or later depending on the currently deployed branch. As an interim measure, administrators should review authentication logs for suspicious userID-based login attempts that bypass SSO, and consider enforcing additional network-level access controls to restrict direct API authentication. After patching, verify that SSO-only login policies are correctly enforced (Mattermost Security).