CVE-2026-58066

Analyzed Analyzed - Analysis Complete

SAML Signature Bypass in Rocket.Chat

Publication date: 2026-07-30

Last updated on: 2026-08-25

Assigner: HackerOne

Description

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-25

Generated

2026-09-08

AI Q&A

2026-07-30

EPSS Evaluated

2026-09-07

NVD

CVE-2026-58066

EUVD

EUVD-2026-51023

Affected Vendors & Products

Vendor	Product	Version / Range
rocket.chat	rocket.chat	to 7.10.14 (exc)
rocket.chat	rocket.chat	From 8.0.0 (inc) to 8.0.8 (exc)
rocket.chat	rocket.chat	From 8.1.0 (inc) to 8.1.7 (exc)
rocket.chat	rocket.chat	From 8.2.0 (inc) to 8.2.7 (exc)
rocket.chat	rocket.chat	From 8.3.0 (inc) to 8.3.7 (exc)
rocket.chat	rocket.chat	From 8.4.0 (inc) to 8.4.5 (exc)
rocket.chat	rocket.chat	From 8.5.0 (inc) to 8.5.2 (exc)
rocket.chat	rocket.chat	From 8.6.0 (inc) to 8.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Rocket.Chat's SAML SSO before specific versions did not properly bind validated XML signatures to the SAML response or assertion. This allowed attackers to submit a forged document with fake identity attributes while using a valid signature from a trusted Identity Provider (IdP), enabling unauthorized user login as any arbitrary account.

Detection Guidance

To detect this vulnerability, check if your Rocket.Chat instance is running a vulnerable version (before 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, or 7.10.14). Verify if SAML SSO responses are properly validated and bound to the correct user attributes.

Impact Analysis

An attacker could exploit this to impersonate any user, gaining unauthorized access to sensitive data, administrative functions, or private conversations. This could lead to data breaches, unauthorized actions, or complete account takeover within Rocket.Chat deployments using affected versions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Update Rocket.Chat to a patched version (8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, or 7.10.14) to address the SAML SSO signature validation flaw. Review and apply the security hotfix changes from Pull Request #41233 to prevent forged identity attributes from being accepted.

Hi! I’m here to help you understand CVE-2026-58066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70