CVE-2026-55759

Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay

State: Published
Severity: 7.4 High
Published: Jun 24, 2026
Updated: Jun 26, 2026
Reserved: Jun 17, 2026

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss is accepted regardless of aud, exp, nbf, or nonce. An attacker who obtains a target user's Apple identity token (from server logs, an intercepted sign-in flow, or another application sharing the same Apple developer team) can replay it to authenticate as that user, with no expiration on the replay window. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-287 Improper Authentication
CWE-294 Authentication Bypass by Capture-replay

Affected Products

Product	Versions
Rocket.ChatRocketChat	>= 8.5.0-rc.0, < 8.5.1Affected >= 8.4.0-rc.0, < 8.4.4Affected >= 8.3.0-rc.0, < 8.3.6Affected >= 8.2.0-rc.0, < 8.2.6Affected >= 8.1.0-rc.0, < 8.1.6Affected >= 7.11.0-rc.0, < 8.0.7Affected < 7.10.13Affected

References

https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-c75c-5hc7-j4vp

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.