Executive brief
Rocket.Chat, a popular team communication and collaboration platform, exposes an unauthenticated password reset email function that lacks rate limiting. An attacker can repeatedly trigger password reset emails to any address and enumerate valid user accounts by analyzing response differences, potentially leading to spam campaigns and account information disclosure.
Technical details
The sendForgotPasswordEmail Meteor method is accessible without authentication via DDP protocol and the HTTP endpoint POST /api/v1/method.callAnon/sendForgotPasswordEmail, but lacks a DDPRateLimiter rule to restrict call frequency. An unauthenticated attacker can invoke the method unlimited times from a single source, triggering unbounded password reset emails to any target address. The method's response varies based on account state—returning true for non-existent addresses and successful sends, but false for accounts using OAuth authentication with Accounts_AllowPasswordChangeForOAuthUsers disabled—allowing attackers to enumerate account types through differential responses. The vulnerability permits both denial-of-service via email spam and account discovery at scale. Patches registered a rate limit of ten calls per minute per client address in later versions.
Affected products
- Rocket.Chat Rocket.Chat prior to fix commit 3a61c3a
Timeline
- 2026-08-25: disclosed
- 2026: patched: Rate limit of 10 calls per minute per client address implemented