CVE-2026-30831

Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer

State: Published
Severity: 8.0 High
Published: Mar 6, 2026
Updated: Mar 11, 2026
Reserved: Mar 5, 2026

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.

Scores

CVSS	Score	Vector	Source
4.0	8.0 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U	GitHub_M

Weaknesses

CWE-287 Improper Authentication
CWE-304 Missing Critical Step in Authentication

Affected Products

Product	Versions
Rocket.ChatRocketChat	< 7.10.8Affected < 7.11.5Affected < 7.12.5Affected < 7.13.4Affected < 8.0.2Affected < 8.1.1Affected < 8.2.0Affected

References

https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-7qr6-q62g-hm63

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.