Rocket.Chat's CAS login handler in versions prior to 7.10.11, 7.13.7, 8.0.5, 8.1.4, 8.2.3, 8.3.3, 8.4.1, and 8.5.0 forwards the client-supplied options.cas.credentialToken value directly into a MongoDB findOne({_id: ...}) query without runtime type checks. Because TypeScript's string annotations are erased at runtime, an attacker can supply a MongoDB query operator (e.g., {"$gt": ""}, {"$ne": null}) instead of a string token. This injected operator matches the first unexpired document in the credential_tokens collection, bypassing CAS ticket validation. When a legitimate CAS or SAML SSO login is in progress, the attacker’s subsequent login call matches the same credential token and receives a full Meteor authentication token bound to the victim user. If the victim is an administrator, this leads to full instance compromise via app installation. The vulnerability is addressed in versions 7.10.11, 7.13.7, 8.0.5, 8.1.4, 8.2.3, 8.3.3, 8.4.1, and 8.5.0.

An unauthenticated attacker can bypass CAS ticket validation by injecting NoSQL operators into the credentialToken parameter, allowing them to obtain a valid authentication token for any user currently authenticating, including administrators. This results in full user impersonation and, if the victim is an admin, complete instance compromise through app installation capabilities. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

This vulnerability is fixed in Rocket.Chat versions 7.10.11, 7.13.7, 8.0.5, 8.1.4, 8.2.3, 8.3.3, 8.4.1, and 8.5.0. Users should upgrade to one of these versions or later to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is not explicitly confirmed beyond the stated fixed versions; therefore, verify with official Rocket.Chat advisories for current remediation guidance.