CVE-2026-58066

Published: Jul 30, 2026Modified: Aug 25, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: support@hackerone.com (Secondary)

Description

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

Affected (8)

Products: Rocket.chat: Rocket.chat

Rocket.chat

1 product

Rocket.chat

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Rocket.chat Rocket.chat	version < 7.10.14
Rocket.chat Rocket.chat	8.0.0 ≤ version < 8.0.8
Rocket.chat Rocket.chat	8.1.0 ≤ version < 8.1.7
Rocket.chat Rocket.chat	8.2.0 ≤ version < 8.2.7
Rocket.chat Rocket.chat	8.3.0 ≤ version < 8.3.7
Rocket.chat Rocket.chat	8.4.0 ≤ version < 8.4.5
Rocket.chat Rocket.chat	8.5.0 ≤ version < 8.5.2
Rocket.chat Rocket.chat	8.6.0 ≤ version < 8.6.1

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://github.com/RocketChat/Rocket.Chat/pull/41233

Source: support@hackerone.com

Issue Tracking

https://hackerone.com/reports/3827674

Source: support@hackerone.com

Third Party AdvisoryIssue Tracking

Timeline

No history available yet.