CVE-2026-55666

Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth

State: Published
Severity: 9.3 Critical
Published: Jun 24, 2026
Updated: Jun 29, 2026
Reserved: Jun 17, 2026

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an email parameter. If the JWT does not contain an email address, the application falls back to accepting an arbitrary email value supplied directly in the request. Attackers are able to forge Apple JWTs that do not contain an email address and leverage this vulnerability to carry out account takeover attacks. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-287 Improper Authentication
CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

Product	Versions
Rocket.ChatRocketChat	>= 8.5.0-rc.0, < 8.5.1Affected >= 8.4.0-rc.0, < 8.4.4Affected >= 8.3.0-rc.0, < 8.3.6Affected >= 8.2.0-rc.0, < 8.2.6Affected >= 8.1.0-rc.0, < 8.1.6Affected >= 7.11.0-rc.0, < 8.0.7Affected < 7.10.13Affected

References

https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-wx3c-76rf-wpwf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.