Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRocket.chat
APPRocket.Chat< 7.10.148.0.0 – 8.0.8 (excl.)8.1.0 – 8.1.7 (excl.)8.2.0 – 8.2.7 (excl.)8.3.0 – 8.3.7 (excl.)8.4.0 – 8.4.5 (excl.)8.5.0 – 8.5.2 (excl.)8.6.0 – 8.6.1 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
Related vulnerabilities
CVE-2026-48616CRITICAL9.3PL ✓same product
Rocket.Chat — podatność access control w plikach Livechat (nieautoryzowany dostęp)
CVE-2026-29198CRITICAL9.8PL ✓same product
Rocket.Chat — NoSQL injection umożliwiający przejęcie konta (SQLi)
CVE-2026-28514CRITICAL9.3PL ✓same product
Rocket.Chat — pominięcie await powoduje auth bypass w ddp-streamer
CVE-2023-28316CRITICAL9.8PL ✓same product
Rocket.Chat: brak unieważnienia sesji po aktywacji 2FA
CVE-2022-44567CRITICAL9.8PL ✓same product
Command Injection i RCE w Rocket.Chat Desktop via openInternalVideoChatWindow