CVE-2026-28514

The vulnerability arose from omitting the await keyword when calling an asynchronous password validation function. As a result, instead of a real logical result (true/false), a Promise object is compared, which in JavaScript is always a truthy value. This means that every authentication attempt succeeds regardless of the password provided. An attacker only needs to know or guess the username to gain full access to the account.

An attacker can take over any Rocket.Chat user account whose username is known or can be guessed, thereby gaining access to private messages, channels, and data. In corporate environments, this could lead to disclosure of confidential information or lateral movement.

Rocket.Chat should be immediately updated to version 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, or 8.0.0, depending on the branch in use. Patches are available in the official GitHub repository of the vendor. Until the update is applied, consider restricting network access to the Rocket.Chat instance and monitoring authentication logs for anomalies.

Rocket.Chat in versions earlier than 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0 — affects installations using the ddp-streamer microservice.