CVE-2026-22545
Password Change Bypass via Auth Switch Endpoint
Résumé
Password Change Bypass via Auth Switch Endpoint
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows an authenticated attacker to change account password without confirmation via falsely claiming a different auth provider.. Mattermost Advisory ID: MMSA-2026-00583
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory mattermost.com
- advisory nvd.nist.gov