CVE-2026-45677 is a missing authorization vulnerability in Rocket.Chat's SAML integration prior to versions 7.10.11, 7.13.7, 8.0.5, 8.1.4, 8.2.3, 8.3.3, 8.4.1, and 8.5.0. The software does not verify the signature on inbound LogoutRequest messages, allowing an unauthenticated remote attacker who knows a user's SAML NameID (commonly the user's email address) to craft and submit unsigned LogoutRequest messages to the service provider's logout endpoint. The server processes these requests as legitimate, immediately terminating the victim's session. This attack requires no authentication or victim interaction and can be automated to disrupt multiple users, effectively causing a denial of service for SAML-authenticated users. The vulnerability is fixed in the specified versions.

An unauthenticated attacker can forcibly log out any SAML-authenticated user by submitting unsigned LogoutRequest messages that the server accepts as valid. This can be done repeatedly or at scale to disrupt user access, effectively causing a denial of service condition for affected Rocket.Chat instances. There is no indication of data disclosure or privilege escalation beyond session termination.

Fixes for this vulnerability are available in Rocket.Chat versions 7.10.11, 7.13.7, 8.0.5, 8.1.4, 8.2.3, 8.3.3, 8.4.1, and 8.5.0. Users should upgrade to one of these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisory stating the vulnerability is fixed in these versions.