CVE-2026-58066 Auth bypass in Rocket.Chat
Attackers can bypass SAML authentication in Rocket.Chat by submitting forged identity attributes with a valid signature, allowing them to log in as arbitrary users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58066?
CVE-2026-58066 is a critical authentication bypass vulnerability in Rocket.chat Rocket.chat, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
Weakness: CWE-287
Which versions are affected by CVE-2026-58066?
It affects 1 product.
Products include Rocket.chat Rocket.chat.
How do I fix CVE-2026-58066?
No fix has been published for CVE-2026-58066 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-58066 being exploited?
There is no known exploitation of CVE-2026-58066 in the wild and no public exploit code.
Other vulnerabilities in Rocket.chat Rocket.chat
Sources
Also known as GHSA-f3wj-pr2w-q3fm.