Executive brief
Rocket.Chat, a popular open-source communications platform, is affected by a critical security flaw in how it handles authentication for third-party applications. An attacker can exploit this to take over the account of the first user who has a generated security token. This could lead to unauthorized access to sensitive corporate communications and full administrative control over the chat environment.
Technical details
A NoSQL injection vulnerability exists in Rocket.Chat's handling of OAuth2 authentication tokens. When an OAuth application is configured, the system fails to properly sanitize or validate token-related queries, allowing an attacker to inject NoSQL commands. This flaw can be exploited to identify and hijack the session or account of the first user associated with a generated token. The vulnerability is reachable over the network without prior authentication. Patches have been released across multiple major versions (7.x and 8.x) to address the improper neutralization of special elements in database queries.
Affected products
- Rocket.Chat Rocket.Chat < 8.3.0, < 8.2.1, < 8.1.2, < 8.0.3, < 7.13.5, < 7.12.6, < 7.11.6, < 7.10.9
Timeline
- 2026-03-10: patched: Fix merged into Rocket.Chat develop branch
- 2026-04-23: disclosed: Initial disclosure via HackerOne/NVD