CVE-2026-45677
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Rocket.Chat prior to version 8.5.0 does not verify the signature on LogoutRequest messages in SAML integration. An unauthorized attacker can craft a fake logout request, leading to the immediate termination of the victim's session.
Risk Assessment
An attacker can repeatedly log out users utilizing SAML authentication, resulting in loss of access to the Rocket.Chat platform for those users. This may cause disruptions in communication within the organization.
Recommendation
It is recommended to upgrade to versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11 to mitigate this vulnerability.
Other vulnerabilities in Rocket.Chat
See all- CVE-2026-23477High
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.
- CVE-2026-58066Critical
In Rocket.Chat before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14, SAML SSO verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
- CVE-2026-55666Critical
In Rocket.Chat prior to versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in loginHandler.ts, handleIdentityToken parses a JWT from Apple during OAuth. If the JWT lacks an email, the app accepts an arbitrary email from the request, enabling account takeover.
- CVE-2026-48616Critical
Rocket.Chat versions below 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 have an access control vulnerability in Livechat files. The authorization process for downloading protected files does not verify that rc_rid matches the requested file, allowing unauthenticated discovery of all uploaded files.
- CVE-2026-29198Critical
In Rocket.Chat versions below 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured.
- CVE-2026-75575Medium
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, allowing unauthenticated callers to invoke it repeatedly. The method is reachable over DDP and HTTP POST /api/v1/method.callAnon/sendForgotPasswordEmail, triggering password reset emails for any address matching an account. With no DDPRateLimiter rule, attackers can send unbounded volumes of reset mail and probe addresses at scale.
- CVE-2026-65645Medium
In Rocket.Chat before versions 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the DDP methods getThreadsList and getThreadMessages accept raw, untyped parameters. A MongoDB operator object can be substituted for a string room-id or message-id, leading to disclosure of private thread parents and their full reply content to any low-privilege authenticated user.
- CVE-2026-65644High
In Rocket.Chat before versions 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the REST API endpoint POST /api/v1/livechat/visitor accepts an unauthenticated, unsanitized name field. This name is stored raw and rendered via dangerouslySetInnerHTML, injecting a clickable HTML link into the DOM of any agent viewing the queue.
- CVE-2026-72919Medium
In Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated user with create-team permission to convert an unrelated public channel by supplying channelName instead of channelId because the edit-room permission is checked only for channelId.
- CVE-2026-72918Medium
In Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat.
Original NVD description (English source)
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML integration does not verify the signature on inbound LogoutRequest messages. An unauthenticated remote attacker who knows a target user's SAML NameID - which major identity providers (Okta, Google Workspace, Microsoft Entra ID, JumpCloud) expose as the user's email address - can craft a valid-looking unsigned LogoutRequest and submit it to the SP logout endpoint. The server processes it as legitimate, immediately destroying the victim's session. Because the attack requires no authentication and no interaction from the victim, it can be repeated in a loop against individual users or scripted across many accounts, effectively rendering the Rocket.Chat instance unusable for SAML-authenticated users. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.