# CVE-2026-45688: Rocket.Chat NoSQL injection in CAS login handler

Source: https://junglewise.ai/threats/cve-2026-45688-rocket-chat-nosql-injection-in-cas-login-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-45688 · Severity: critical · CVSS 9.1 · Published 2026-06-24

Rocket.Chat is an open-source communications platform used for team collaboration and messaging. A security flaw in its login system allows an unauthenticated attacker to hijack the sessions of other users, including administrators, when they log in using Single Sign-On (SSO) services like CAS or SAML. If an administrator's account is compromised, the attacker could gain full control over the server, potentially leading to data theft or complete service disruption.

Technologies: [Rocket.Chat](https://junglewise.ai/threats/technologies/rocket-chat). Vendors: [Rocket.Chat](https://junglewise.ai/threats/vendors/rocket-chat).

## Quick answers

**Is CVE-2026-45688 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45688 being exploited in the wild.

**How severe is CVE-2026-45688?** Critical severity, with a CVSS score of 9.1, published 24 June 2026.

**Which products and versions are affected?** Rocket.Chat < 8.5.0, < 8.4.1, < 8.3.3, < 8.2.3, < 8.1.4, < 8.0.5, < 7.13.7, < 7.10.11.

**Is there a fix for CVE-2026-45688?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45688 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45688?** Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NoSQL injection vulnerability exists in the CAS login handler of Rocket.Chat due to a lack of type validation on the 'options.cas.credentialToken' parameter. While TypeScript annotations suggest a string, the runtime erasure allows an attacker to pass a MongoDB query operator (e.g., {"$gt": ""}) into a 'findOne' query. This bypasses the intended ticket check by matching any unexpired document in the 'credential_tokens' collection. Because the CAS handler is registered unconditionally and shares a collection with the SAML provider, attackers can intercept session tokens for any user performing an SSO login within a 60-second window. Successful exploitation provides a full Meteor authentication token, which can be used to access REST and DDP APIs. If an administrator is targeted, the attacker can achieve RCE via the Apps-Engine. The issue is fixed in versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

## Affected products

- RocketChat Rocket.Chat < 8.5.0, < 8.4.1, < 8.3.3, < 8.2.3, < 8.1.4, < 8.0.5, < 7.13.7, < 7.10.11

## Timeline

- 2026-05-14: advisory: Vendor security advisory published on GitHub
- 2026-06-24: disclosed: CVE published to NVD

## References

- [https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-rr54-jf4h-6cj9](https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-rr54-jf4h-6cj9)

## Related threats

- [Rocket.Chat sendForgotPasswordEmail method missing DDP rate limit](https://junglewise.ai/threats/cve-2026-75575-rocket-chat-sendforgotpasswordemail-method-missing-ddp-rate-limit)
- [Rocket.Chat Meteor DDP method authorization bypass](https://junglewise.ai/threats/cve-2026-65645-rocket-chat-meteor-ddp-method-authorization-bypass)
- [Rocket.Chat Omnichannel queue stored XSS via visitor name](https://junglewise.ai/threats/cve-2026-65644-rocket-chat-omnichannel-queue-stored-xss-via-visitor-name)
- [Rocket.Chat authentication bypass in SAML SSO](https://junglewise.ai/threats/cve-2026-58066-rocket-chat-authentication-bypass-in-saml-sso)
- [Rocket.Chat missing authorization in fingerprint REST endpoint](https://junglewise.ai/threats/cve-2026-55762-rocket-chat-missing-authorization-in-fingerprint-rest-endpoint)