Executive brief
Rocket.Chat is a communication and collaboration platform used by organizations for internal messaging. A security flaw in its Apple Sign-In feature allows an attacker to reuse a user's login token to gain unauthorized access to their account. This could lead to the exposure of private conversations and sensitive corporate data, as the system fails to check if the login token has expired or was intended for a different application.
Technical details
The Apple Sign-In handler in Rocket.Chat uses the `JWS.verify` function from the `jsrsasign` library, which validates the cryptographic signature but ignores JWT claims. Specifically, the implementation fails to verify the audience (aud), expiration (exp), 'not before' (nbf), or nonce claims. An attacker who obtains a valid Apple identity token—via server logs, intercepted traffic, or a shared developer team environment—can replay that token to authenticate as the target user. Because expiration claims are ignored, the window for replaying these tokens is indefinite. The vulnerability is addressed in versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.
Affected products
- RocketChat Rocket.Chat < 8.5.1, < 8.4.4, < 8.3.6, < 8.2.6, < 8.1.6, < 8.0.7, < 7.10.13
Timeline
- 2026-06-16: advisory: GitHub security advisory published by Rocket.Chat
- 2026-06-24: disclosed: CVE published to NVD