CVE-2026-0999: Authentication bypass via userID login when email and username login are disabled

Q: What is the severity of CVE-2026-0999?

CVE-2026-0999 is considered a high-severity vulnerability due to its potential for authentication bypass.

Q: How do I fix CVE-2026-0999?

To remediate CVE-2026-0999, update Mattermost to the latest versions that address the improper validation of login method restrictions.

Q: What versions are affected by CVE-2026-0999?

CVE-2026-0999 affects Mattermost versions 11.1.x up to 11.1.2, 10.11.x up to 10.11.9, and 11.2.x up to 11.2.1.

Q: What causes the CVE-2026-0999 vulnerability?

CVE-2026-0999 is caused by a failure in properly validating login method restrictions which allows bypassing SSO-only login requirements.

Q: Can CVE-2026-0999 lead to further attacks?

Yes, if exploited, CVE-2026-0999 may allow unauthorized access to user accounts, potentially leading to further attacks.

Published Feb 16, 2026

Updated

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548

Affected Software

4 affected components

Mattermost Mattermost<=11.1.2, <=10.11.9, <=11.2.1

Mattermost Mattermost Server>=10.11.0<10.11.10

Mattermost Mattermost Server>=11.1.0<11.1.3

Mattermost Mattermost Server>=11.2.0<11.2.2

Remediation

Information

Update Mattermost to versions 11.3.0, 11.1.3, 10.11.10, 11.2.2 or higher.

Event History

Feb 16, 2026

CVE Published

via MITRE·09:47 AM

Data Sourced

via MITRE·09:47 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0999?

CVE-2026-0999 is considered a high-severity vulnerability due to its potential for authentication bypass.

How do I fix CVE-2026-0999?