{"id":"CVE-2026-19076","kind":"vulnerability","aliases":["CVE-2026-19076"],"related":[],"title":"Mattermost: OAuth tokens can take over SSO accounts via account switch","description":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch.. Mattermost Advisory ID: MMSA-2026-00758","summary":"Mattermost fails to reject OAuth application sessions at its account type switch endpoint, POST /api/v4/users/login/switch. An attacker holding a valid OAuth bearer token for a user can set a password on that SSO-backed account and detach it from the identity provider, which gives them permanent control of the account.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mattermost","oauth","package","self-hosted","sso"],"not_affected_if":["default-config","no-oauth-apps"],"how_to_check":"- Check the Mattermost server version and compare it against the affected ranges: 11.7.x up to 11.7.9, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, and 11.10.x up to 11.10.0.\n- Review OAuth application grants and tokens for unexpected use against POST /api/v4/users/login/switch in server logs.","fix":"- Upgrade Mattermost to a release that includes the MMSA-2026-00758 fix (the sources do not name the fixed versions).\n- Revoke OAuth application sessions and tokens for affected users after upgrading.","status":"open","published_at":"2026-10-16T08:17:13+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:37:13+00:00","updated_at":"2026-10-25T04:37:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a release that includes the MMSA-2026-00758 fix (the sources do not name the fixed versions).\n- Revoke OAuth application sessions and tokens for affected users after upgrading.","reach":"network","title":"Mattermost: OAuth tokens can take over SSO accounts via account switch","impact":"high","summary":"Mattermost fails to reject OAuth application sessions at its account type switch endpoint, POST /api/v4/users/login/switch. An attacker holding a valid OAuth bearer token for a user can set a password on that SSO-backed account and detach it from the identity provider, which gives them permanent control of the account.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted","sso","oauth"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker permanently takes over SSO-backed user accounts.","analyst_note":"Check the Mattermost advisory MMSA-2026-00758 for the fixed versions and whether OAuth apps are enabled by default.","how_to_check":"- Check the Mattermost server version and compare it against the affected ranges: 11.7.x up to 11.7.9, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, and 11.10.x up to 11.10.0.\n- Review OAuth application grants and tokens for unexpected use against POST /api/v4/users/login/switch in server logs.","needs_analyst":true,"not_affected_if":["default-config","no-oauth-apps"],"who_is_affected":"Self-hosted or managed Mattermost servers in the listed version ranges that use SSO (such as SAML, GitLab or OAuth identity providers) with OAuth applications enabled. Exposure requires a valid OAuth bearer token for the target user, so teams without OAuth apps issuing tokens face less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":3456,"output_tokens":684,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00758':155C '-19076':14A,17A '-2026':13A,16A,154C '..':149C '/api/v4/users/login/switch':39B,148C '11.10':78C '11.10.0':80C '11.7':81C '11.7.9':83C '11.8':87C '11.8.5':89C '11.9':84C '11.9.1':86C 'account':8A,10A,34B,60B,75B,98C,126C,137C 'advisori':151C 'allow':103C 'applic':30B,94C 'attack':41B,105C,131C 'attacker-control':130C 'back':59B,125C 'bearer':46B,110C 'control':72B,132C 'craft':144C 'cve':12A,15A 'detach':62B,135C 'endpoint':37B,101C 'fail':26B,90C 'give':69B 'hold':42B 'host':23B 'id':152C 'ident':66B,140C 'mattermost':1A,18B,25B,76C,150C 'mmsa':153C 'oauth':2A,19B,29B,45B,93C,109C 'packag':20B 'password':54B,133C 'perman':71B,117C 'post':38B,147C 'provid':67B,141C 'reject':28B,92C 'request':145C 'self':22B 'self-host':21B 'session':31B,95C 'set':52B,128C 'sso':7A,24B,58B,124C 'sso-back':57B,123C 'switch':11A,36B,100C 'take':5A,118C 'target':114C 'token':3A,47B,111C 'type':35B,99C 'user':50B,115C,121C 'valid':44B,108C 'version':77C 'via':9A,142C 'x':79C,82C,85C,88C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Mattermost servers in the listed version ranges that use SSO (such as SAML, GitLab or OAuth identity providers) with OAuth applications enabled. Exposure requires a valid OAuth bearer token for the target user, so teams without OAuth apps issuing tokens face less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T08:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19076","severity":null,"published_at":"2026-10-16T08:17:13+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}