Mattermost versions 11.10.x through 11.8.x unconditionally accept OAuth application sessions when a user switches account type. An attacker possessing a valid OAuth bearer token for a target user can exploit this flaw by sending a crafted POST /api/v4/users/login/switch request, setting a new password, and detaching the account from its identity provider. This results in permanent takeover of the user’s SSO‑backed account.

Mattermost Mattermost Versions affected include 11.10.x up to and including 11.10.0, 11.7.x up to 11.7.9, 11.9.x up to 11.9.1, and 11.8.x up to 11.8.5.

The CVSS score of 4.4 indicates medium severity, and the EPSS score of 0.00197 shows a probability of exploitation of less than 1%. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is an attacker who already has a valid OAuth bearer token for the target user, which can be obtained through initial compromise or social engineering. Once the token is in hand, the attacker can permanently take over the account by using the switch endpoint to set a new password and detach the identity provider.