Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548
Weakness
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mattermost_server | Mattermost | 10.11.0 (including) | 10.11.10 (excluding) |
| Mattermost_server | Mattermost | 11.1.0 (including) | 11.1.3 (excluding) |
| Mattermost_server | Mattermost | 11.2.0 (including) | 11.2.2 (excluding) |