Vulnerability · Published Jul 30, 2026 · Assigned by hackerone
CVE-2026-58066
Critical 9.8
In plain English
A critical-severity improper authentication in Rocket.Chat from Rocket.Chat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rocket.Chat | Rocket.Chat | 0 – before 8.7.00 – before 8.6.10 – before 8.5.20 – before 8.4.50 – before 8.3.70 – before 8.2.70 – before 8.1.70 – before 8.0.8 |
Weakness: CWE-287 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H