The vulnerability arises from the Mattermost server failing to constrain excessively long passwords during authentication. Login attempts containing multi‑megabyte passwords consume excessive CPU cycles and memory, leading to resource exhaustion. This can result in a denial of service where legitimate users are unable to authenticate or the server becomes unresponsive. The weakness is identified as CWE‑770 (Resource Exhaustion).

Affected systems are Mattermost server deployments running any of the following versions: 10.11.x up to and including 10.11.10, 11.2.x up to and including 11.2.2, and 11.3.x up to and including 11.3.0. The issue is present in all Mattermost releases prior to 10.11.11, 11.2.3, and 11.3.1 respectively.

The CVSS score for this issue is 7.5, indicating a high‑severity attack. EPSS indicates a low probability of exploitation (<1%). The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to send login requests to the server. An attacker can exploit it remotely by submitting forged authentication attempts with very large password fields, consuming server resources until the service degrades or an outage occurs.