CVE-2026-58066

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-287

Description

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

References

https://github.com/RocketChat/Rocket.Chat/pull/41233
https://hackerone.com/reports/3827674

Status: profiled · ingested 2026-07-31T06:00:00.000Z