CVE-2026-22560 Open redirect in Rocket.Chat

What is CVE-2026-22560?

CVE-2026-22560 is a medium-severity vulnerability in Rocket.chat Rocket.chat, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint.

Weakness: CWE-601

Which versions are affected by CVE-2026-22560?

It affects 1 product.

Products include Rocket.chat Rocket.chat.

How do I fix CVE-2026-22560?

No fix has been published for CVE-2026-22560 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-22560 being exploited?

There is no known exploitation of CVE-2026-22560 in the wild and no public exploit code.

Other vulnerabilities in Rocket.chat Rocket.chat

• CVE-2026-58066 Auth bypass in Rocket.Chat Critical 9.8
• CVE-2026-29198 SQL injection in Rocket.Chat Critical 9.8
• CVE-2023-28316 Security feature bypass in Rocket.Chat Critical 9.8
• CVE-2022-44567 Command injection in Rocket.chat - Electron Desktop Critical 9.8
• CVE-2021-22910 Code injection in Rocket.Chat server Critical 9.8

All Rocket.chat Rocket.chat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8fhh-33x2-c7c5.