Executive brief
Rocket.Chat is a communication platform used for team collaboration and messaging. A security flaw in its login system allows attackers to bypass authentication and log in as any user, including administrators, if the SAML login feature was enabled without a security certificate. This could lead to a total takeover of the workspace, allowing unauthorized access to private messages, files, and administrative settings.
Technical details
The vulnerability exists in Rocket.Chat's SAML service provider implementation within the `verifySignatures` routine. When the `serviceProviderOptions.cert` setting is empty (its default state), the routine performs an early return without performing any XML-DSig verification on the SAML Response or Assertion. Because the application allows the SAML feature to be enabled without requiring a certificate, a publicly reachable endpoint is created that accepts unsigned or attacker-crafted assertions. An unauthenticated remote attacker can exploit this by submitting a crafted SAML assertion to the ACS endpoint, naming a target user (such as an admin) to obtain a valid session. The issue is fixed in versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.
Affected products
- RocketChat Rocket.Chat < 8.5.0, < 8.4.1, < 8.3.3, < 8.2.3, < 8.1.4, < 8.0.5, < 7.13.7, < 7.10.11
Timeline
- 2026-05-14: advisory: Vendor advisory published on GitHub
- 2026-06-24: disclosed: CVE published to NVD