Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-58066

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rocket.Chat Rocket.Chat

Default version status: unaffected

  • 0 to < 8.7.0affected
  • 0 to < 8.6.1affected
  • 0 to < 8.5.2affected
  • 0 to < 8.4.5affected
  • 0 to < 8.3.7affected
  • 0 to < 8.2.7affected
  • 0 to < 8.1.7affected
  • 0 to < 8.0.8affected
  • 0 to < 7.10.14affected

References