CVE-2026-46423 is an improper verification of cryptographic signature vulnerability (CWE-347) in Rocket.Chat's SAML service provider implementation. Prior to versions 7.10.11, 7.13.7, 8.0.5, 8.1.4, 8.2.3, 8.3.3, 8.4.1, and 8.5.0, the verifySignatures routine returns early without validating signatures if the IdP certificate field is empty (which is the default). This results in a fail-open authentication bypass where unsigned or attacker-supplied SAML assertions are accepted, exposing the system to unauthorized access. The vulnerability is triggered by enabling SAML without providing an IdP certificate, which is a default configuration state. The issue is resolved in the specified fixed versions.

This vulnerability allows an attacker to bypass authentication by submitting unsigned or attacker-controlled SAML assertions to the Rocket.Chat SAML login endpoint. Because signature verification is skipped when the IdP certificate is not configured, an attacker can gain unauthorized access without valid credentials. The vulnerability affects default configurations where the IdP certificate field is left empty. The CVSS 4.0 score is 9.3 (critical), indicating a high-impact remote, unauthenticated attack with high confidentiality and integrity impact.

A fix is available in Rocket.Chat versions 7.10.11, 7.13.7, 8.0.5, 8.1.4, 8.2.3, 8.3.3, 8.4.1, and 8.5.0. Users should upgrade to one of these versions or later to remediate this vulnerability. Until upgraded, administrators must ensure that the IdP certificate field is properly configured and not left empty when enabling SAML to avoid the authentication bypass. Patch status is confirmed by the vendor advisory stating the vulnerability is fixed in these versions.