Mattermost Authentication Method Validation Vulnerability Allowing Password Change Without Confirmation

A vulnerability exists in Mattermost versions 10.11.x prior to 10.11.10, where the application fails to properly validate the user's authentication method during account type switches. This flaw enables an authenticated attacker to change a user's password without confirmation by falsely claiming to use a different authentication provider.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, potentially leading to account takeover.

Remediation

Users can upgrade to Mattermost version 10.11.10 or later to address this vulnerability.