CVE-2026-58066

State: Published
Severity: 9.8 Critical
Published: Jul 30, 2026
Updated: Jul 31, 2026
Reserved: Jun 28, 2026

Description

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

Scores

CVSS	Score	Vector	Source
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	hackerone

Weaknesses

CWE-287 Improper Authentication - Generic

Affected Products

Product	Versions
Rocket.ChatRocket.Chat	before 8.7.0Affected before 8.6.1Affected before 8.5.2Affected before 8.4.5Affected before 8.3.7Affected before 8.2.7Affected before 8.1.7Affected before 8.0.8Affected before 7.10.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.