by Kastro
Paper/Archive/CVE-2026-58066

CVE-2026-58066

Rocket.Chat Rocket.Chat — Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but di…

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 32.2.322 × 206.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

Affected

ProductAffectedFixed inSource
Rocket.Chat< 8.7.08.7.0CNA
Rocket.Chat< 8.6.18.6.1CNA
Rocket.Chat< 8.5.28.5.2CNA
Rocket.Chat< 8.4.58.4.5CNA
Rocket.Chat< 8.3.78.3.7CNA
Rocket.Chat< 8.2.78.2.7CNA
Rocket.Chat< 8.1.78.1.7CNA
Rocket.Chat< 8.0.88.0.8CNA
Rocket.Chat< 7.10.147.10.14CNA

Scores by source

hackerone (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhackerone.com/reports/3827674refgithub.com/RocketChat/Rocket.Chat/pull/41233