CVE-2026-30831 Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer

What is CVE-2026-30831?

CVE-2026-30831 is a high-severity authentication bypass vulnerability in Rocket.chat Rocket.chat, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.

Weakness: CWE-304, CWE-287

Which versions are affected by CVE-2026-30831?

It affects 1 product.

Products include Rocket.chat Rocket.chat.

How do I fix CVE-2026-30831?

No fix has been published for CVE-2026-30831 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-30831 being exploited?

There is no known exploitation of CVE-2026-30831 in the wild and no public exploit code.

Other vulnerabilities in Rocket.chat Rocket.chat

• CVE-2026-58066 Auth bypass in Rocket.Chat Critical 9.8
• CVE-2026-29198 SQL injection in Rocket.Chat Critical 9.8
• CVE-2023-28316 Security feature bypass in Rocket.Chat Critical 9.8
• CVE-2022-44567 Command injection in Rocket.chat - Electron Desktop Critical 9.8
• CVE-2021-22910 Code injection in Rocket.Chat server Critical 9.8

All Rocket.chat Rocket.chat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7qr6-q62g-hm63.