CVE-2026-28514 Rocket.Chat: Users can login with any password via the EE ddp-streamer-service
Attackers can bypass authentication and take over any user account in Rocket.Chat by exploiting a missing await in password validation logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28514?
CVE-2026-28514 is a critical authentication bypass vulnerability in Rocket.chat Rocket.chat, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-28514?
It affects 1 product.
Products include Rocket.chat Rocket.chat.
How do I fix CVE-2026-28514?
No fix has been published for CVE-2026-28514 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-28514 being exploited?
There is no known exploitation of CVE-2026-28514 in the wild and no public exploit code.
Other vulnerabilities in Rocket.chat Rocket.chat
Sources
Also known as GHSA-w6vw-mrgv-69vf.