# CVE-2026-58066: Rocket.Chat authentication bypass in SAML SSO

Source: https://junglewise.ai/threats/cve-2026-58066-rocket-chat-authentication-bypass-in-saml-sso  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-58066 · Severity: critical · CVSS 9.8 · Published 2026-07-30

Rocket.Chat, a popular communication platform, contains a critical security flaw in its Single Sign-On (SSO) system. An attacker can bypass authentication to log in as any user, including administrators, without needing a password. This could lead to a total compromise of the platform, allowing unauthorized access to private messages, sensitive company data, and administrative controls.

Technologies: [Rocket.Chat](https://junglewise.ai/threats/technologies/rocket-chat). Vendors: [Rocket.Chat](https://junglewise.ai/threats/vendors/rocket-chat).

## Quick answers

**Is CVE-2026-58066 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58066 being exploited in the wild.

**How severe is CVE-2026-58066?** Critical severity, with a CVSS score of 9.8, published 30 July 2026.

**Which products and versions are affected?** Rocket.Chat < 8.7.0, < 8.6.1, < 8.5.2, < 8.4.5, < 8.3.7, < 8.2.7, < 8.1.7, < 8.0.8, < 7.10.14.

**Is there a fix for CVE-2026-58066?** A patch was published on 2026-07-08: Fix merged into Rocket.Chat develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58066 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58066?** Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Rocket.Chat's SAML SSO implementation (CWE-287) where XML signatures are verified but not correctly bound to the samlp:Response or saml:Assertion elements. This flaw allows for a 'SAML wrapping' style attack. A remote, unauthenticated attacker can submit a specially crafted XML document containing forged identity attributes alongside a valid signature from a trusted Identity Provider (IdP). Because the application validates the signature but fails to ensure it covers the specific identity claims being processed, the attacker can impersonate any user. The issue is resolved in versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14.

## Affected products

- Rocket.Chat Rocket.Chat < 8.7.0, < 8.6.1, < 8.5.2, < 8.4.5, < 8.3.7, < 8.2.7, < 8.1.7, < 8.0.8, < 7.10.14

## Timeline

- 2026-07-08: patched: Fix merged into Rocket.Chat develop branch
- 2026-07-30: advisory: CVE published via NVD and HackerOne

## References

- [https://github.com/RocketChat/Rocket.Chat/pull/41233](https://github.com/RocketChat/Rocket.Chat/pull/41233)
- [https://hackerone.com/reports/3827674](https://hackerone.com/reports/3827674)

## Related threats

- [Rocket.Chat sendForgotPasswordEmail method missing DDP rate limit](https://junglewise.ai/threats/cve-2026-75575-rocket-chat-sendforgotpasswordemail-method-missing-ddp-rate-limit)
- [Rocket.Chat Meteor DDP method authorization bypass](https://junglewise.ai/threats/cve-2026-65645-rocket-chat-meteor-ddp-method-authorization-bypass)
- [Rocket.Chat Omnichannel queue stored XSS via visitor name](https://junglewise.ai/threats/cve-2026-65644-rocket-chat-omnichannel-queue-stored-xss-via-visitor-name)
- [Rocket.Chat missing authorization in fingerprint REST endpoint](https://junglewise.ai/threats/cve-2026-55762-rocket-chat-missing-authorization-in-fingerprint-rest-endpoint)
- [Rocket.Chat authentication bypass via Apple Sign-In token replay](https://junglewise.ai/threats/cve-2026-55759-rocket-chat-authentication-bypass-via-apple-sign-in-token-replay)