CVE-2026-27656CWE-303

Account Takeover via Substring Matching in OpenID Connect Authentication

Medium · published March 25, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow.. Mattermost Advisory ID: MMSA-2026-00590

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-03-25T16:28Z
EPSS history
Timeline
  • 25 MAR 16:28Z
    Account Takeover via Substring Matching in OpenID Connect Authentication
    cvelistv5