Rocket.Chat's Apple Sign-In handler prior to versions 7.10.13, 8.0.7, 8.1.6, 8.2.6, 8.3.6, 8.4.4, and 8.5.1 improperly authenticates users by verifying JWT signatures but skipping validation of critical claims (aud, exp, nbf, nonce). Any Apple-signed JWT with a non-empty issuer (iss) claim is accepted regardless of these claims. An attacker who obtains a target user's Apple identity token—via server logs, intercepted sign-in flows, or other apps sharing the same Apple developer team—can replay the token to authenticate as that user without expiration on the replay window. This constitutes an improper authentication vulnerability (CWE-287) allowing unauthorized access. The issue is resolved in the listed patched versions.

Successful exploitation allows an attacker to impersonate any user by replaying a valid Apple identity token, bypassing normal authentication controls. This leads to unauthorized access with high confidentiality and integrity impact, but no denial of service. The vulnerability has a CVSS v3.1 score of 7.4 (High), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

This vulnerability is fixed in Rocket.Chat versions 7.10.13, 8.0.7, 8.1.6, 8.2.6, 8.3.6, 8.4.4, and 8.5.1. Users should upgrade to one of these versions or later to remediate the issue. No official vendor advisory or patch links were provided in the input; however, the fix is confirmed in the specified versions. Until upgrading, users should consider restricting access to logs containing Apple identity tokens and monitor for suspicious authentication activity. Patch status is confirmed by the version information in the description.