CRITICAL🇵🇱 Wersja polska

CVE-2023-28316

CVSS 9.8v3.1pub. 2023-05-09upd. 2025-01-28

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Rocket.chat

    APP
    Rocket.Chat
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-58066CRITICAL9.8PL ✓same product

Rocket.Chat SAML SSO — Auth Bypass przez brak wiązania podpisu XML

CVE-2026-48616CRITICAL9.3PL ✓same product

Rocket.Chat — podatność access control w plikach Livechat (nieautoryzowany dostęp)

CVE-2026-29198CRITICAL9.8PL ✓same product

Rocket.Chat — NoSQL injection umożliwiający przejęcie konta (SQLi)

CVE-2026-28514CRITICAL9.3PL ✓same product

Rocket.Chat — pominięcie await powoduje auth bypass w ddp-streamer

CVE-2022-44567CRITICAL9.8PL ✓same product

Command Injection i RCE w Rocket.Chat Desktop via openInternalVideoChatWindow