An authentication flaw in Mattermost server versions 10.11.x through 11.4.x causes the OpenID Connect identity comparison logic to perform an over permissive substring match, allowing attackers to impersonate any user. This results in unauthorized account takeover that can expose sensitive data, allow post creation, or facilitate further attacks. The weakness is categorized as improper authentication (CWE‑303).

Affected vendors and products include Mattermost, specifically Mattermost Server versions up to 11.4.0, 11.3.1, 11.2.3, and 10.11.11. Updates to 11.5.0, 11.4.1, 11.3.2, 11.2.4, or 10.11.12 and later eliminate the flaw.

The CVSS base score is 5.7 indicating medium severity, while the EPSS score is below 1 % showing a relatively low likelihood of current exploitation. It is not listed in the CISA KEV catalog. Exploitation requires only remote access to the OpenID Connect authentication flow and the ability to craft a discovery request that includes a username substring of the target, making the attack feasible in many environments.