# CVE-2026-46423: Rocket.Chat authentication bypass in SAML signature validation

Source: https://junglewise.ai/threats/cve-2026-46423-rocket-chat-authentication-bypass-in-saml-signature-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-46423 · Severity: info · CVSS 9.3 · Published 2026-06-24

Rocket.Chat is a communication platform used for team collaboration and messaging. A security flaw in its login system allows attackers to bypass authentication and log in as any user, including administrators, if the SAML login feature was enabled without a security certificate. This could lead to a total takeover of the workspace, allowing unauthorized access to private messages, files, and administrative settings.

Technologies: [Rocket.Chat](https://junglewise.ai/threats/technologies/rocket-chat). Vendors: [Rocket.Chat](https://junglewise.ai/threats/vendors/rocket-chat).

## Quick answers

**Is CVE-2026-46423 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46423 being exploited in the wild.

**How severe is CVE-2026-46423?** Informational severity, with a CVSS score of 9.3, published 24 June 2026.

**Which products and versions are affected?** Rocket.Chat < 8.5.0, < 8.4.1, < 8.3.3, < 8.2.3, < 8.1.4, < 8.0.5, < 7.13.7, < 7.10.11.

**Is there a fix for CVE-2026-46423?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-46423 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46423?** Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Rocket.Chat's SAML service provider implementation within the `verifySignatures` routine. When the `serviceProviderOptions.cert` setting is empty (its default state), the routine performs an early return without performing any XML-DSig verification on the SAML Response or Assertion. Because the application allows the SAML feature to be enabled without requiring a certificate, a publicly reachable endpoint is created that accepts unsigned or attacker-crafted assertions. An unauthenticated remote attacker can exploit this by submitting a crafted SAML assertion to the ACS endpoint, naming a target user (such as an admin) to obtain a valid session. The issue is fixed in versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

## Affected products

- RocketChat Rocket.Chat < 8.5.0, < 8.4.1, < 8.3.3, < 8.2.3, < 8.1.4, < 8.0.5, < 7.13.7, < 7.10.11

## Timeline

- 2026-05-14: advisory: Vendor advisory published on GitHub
- 2026-06-24: disclosed: CVE published to NVD

## References

- [https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-rgg7-qvp9-wvx7](https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-rgg7-qvp9-wvx7)

## Related threats

- [Rocket.Chat sendForgotPasswordEmail method missing DDP rate limit](https://junglewise.ai/threats/cve-2026-75575-rocket-chat-sendforgotpasswordemail-method-missing-ddp-rate-limit)
- [Rocket.Chat Meteor DDP method authorization bypass](https://junglewise.ai/threats/cve-2026-65645-rocket-chat-meteor-ddp-method-authorization-bypass)
- [Rocket.Chat Omnichannel queue stored XSS via visitor name](https://junglewise.ai/threats/cve-2026-65644-rocket-chat-omnichannel-queue-stored-xss-via-visitor-name)
- [Rocket.Chat authentication bypass in SAML SSO](https://junglewise.ai/threats/cve-2026-58066-rocket-chat-authentication-bypass-in-saml-sso)
- [Rocket.Chat missing authorization in fingerprint REST endpoint](https://junglewise.ai/threats/cve-2026-55762-rocket-chat-missing-authorization-in-fingerprint-rest-endpoint)