CVE-2026-19076: Mattermost OAuth Session Auth Bypass Flaw

CVE-2026-19076 Overview

CVE-2026-19076 is an authorization flaw [CWE-863] in Mattermost affecting the account type switch endpoint. The platform fails to reject OAuth application sessions when processing requests to POST /api/v4/users/login/switch. An attacker holding a valid OAuth bearer token for a target user can set an attacker-controlled password and detach the account from its identity provider. The result is a permanent takeover of an SSO-backed account. Mattermost tracks the issue as advisory MMSA-2026-00758.

Critical Impact
An attacker with a valid OAuth bearer token can permanently hijack an SSO-backed Mattermost account by switching its authentication method to a password they control.

Affected Products

Mattermost 11.10.x versions <= 11.10.0
Mattermost 11.9.x versions <= 11.9.1 and 11.8.x versions <= 11.8.5
Mattermost 11.7.x versions <= 11.7.9

Discovery Timeline

2026-10-16 - CVE-2026-19076 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-19076

Vulnerability Analysis

Mattermost exposes POST /api/v4/users/login/switch to let users change their authentication method, for example switching from SSO to email and password. The endpoint should reject sessions that originated from an OAuth application because those sessions represent delegated, scoped access rather than an interactive user login. Mattermost fails to enforce that restriction. A bearer token issued to an OAuth client is accepted as sufficient authorization to perform the switch operation on the token owner's account.

Once the switch succeeds, the account is detached from its external identity provider and bound to a password supplied by the caller. Future logins no longer traverse the SSO flow, so the legitimate user loses access while the attacker gains persistent control. Account recovery requires administrator intervention.

Root Cause

The root cause is missing authorization context checks on the account type switch handler. The endpoint validates that the bearer token is active and belongs to the target user but does not verify that the session type is an interactive user session. OAuth application sessions, which should be scoped to API operations, are treated as equivalent to full user sessions. This maps directly to [CWE-863] Incorrect Authorization.

Attack Vector

Exploitation requires an attacker to already possess a valid OAuth bearer token for the target user. This typically means the attacker has compromised an OAuth client, phished a token grant, or abused an over-privileged integration. The attacker then sends a crafted POST request to /api/v4/users/login/switch with the bearer token, specifies a transition from the current SSO provider to email-based authentication, and supplies a chosen password. No user interaction is required at the time of exploitation. The CVSS vector reflects high attack complexity and high privilege requirements, consistent with the need for an existing OAuth token.

See the Mattermost Security Updates advisory for protocol-level request details.

Detection Methods for CVE-2026-19076

Indicators of Compromise

Entries in Mattermost audit logs showing successful calls to POST /api/v4/users/login/switch where the session identifier corresponds to an OAuth application rather than a browser-based user session.
Account state changes where AuthService transitions from an SSO provider value (saml, gitlab, office365, openid) to an empty string or email without a corresponding administrator action.
User reports of being unable to sign in through the configured identity provider or being prompted for a password they never set.

Detection Strategies

Correlate OAuth token issuance events with subsequent login/switch invocations by the same session ID; a legitimate workflow should not combine the two.
Alert on any UserAuthServiceChanged or equivalent audit event whose source IP or user agent matches an OAuth integration host rather than an end-user client.
Baseline the normal volume of account authentication method changes; investigate any spike or any change affecting privileged users.

Monitoring Recommendations

Forward Mattermost audit logs to a centralized log platform and retain them for at least 90 days.
Enumerate active OAuth applications and review their scopes, token lifetimes, and recent token grant history on a recurring schedule.
Monitor identity provider logs for drops in SSO authentication volume per user, which can indicate an account was silently detached.

How to Mitigate CVE-2026-19076

Immediate Actions Required

Upgrade Mattermost to a fixed release above 11.10.0, 11.9.1, 11.8.5, or 11.7.9 on the corresponding branch.
Audit POST /api/v4/users/login/switch activity for the last 90 days and identify any requests originating from OAuth sessions.
Revoke OAuth bearer tokens for integrations that are not strictly required and rotate secrets for all remaining OAuth applications.
Force password resets and re-link SSO for any account whose authentication method changed without a corresponding support ticket.

Patch Information

Mattermost has released patched builds documented on the Mattermost Security Updates page under advisory MMSA-2026-00758. Administrators should apply the upgrade to the latest patch level on their current release branch and verify the running version with mmctl version after deployment.

Workarounds

Restrict creation of OAuth applications to a small set of trusted administrators and remove unused OAuth clients.
Place Mattermost behind a reverse proxy or API gateway that blocks POST /api/v4/users/login/switch requests carrying OAuth bearer tokens.
Shorten OAuth access token lifetimes and require refresh token rotation to limit the window of exposure for any leaked token.

bash

# Example reverse proxy rule to block the switch endpoint when an OAuth app token is used
# (NGINX): deny requests to the switch endpoint that originate from known OAuth client IPs
location = /api/v4/users/login/switch {
    if ($http_authorization ~* "^Bearer ") {
        # Allow only requests from the interactive web tier
        if ($remote_addr !~ "^10\.0\.1\.") { return 403; }
    }
    proxy_pass http://mattermost_upstream;
}