Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind… (CVE-2026-58066)
Rocket.Chat versions prior to 7.10.14 and various 8.x releases did not properly bind verified XML signatures to the corresponding SAML Response or Assertion. This flaw allowed an attacker to submit a wrapped SAML document containing forged identity attributes alongside a valid signature from a trusted identity provider, enabling unauthorized login as arbitrary users.
AI Analysis
Technical Summary
The vulnerability in Rocket.Chat's SAML Single Sign-On implementation involves improper binding of XML signatures to the samlp:Response or saml:Assertion elements. Although the XML signatures were verified, the application failed to ensure that the validated signature corresponded to the actual SAML response or assertion being processed. This weakness permits an attacker to craft a wrapped SAML document that carries forged identity attributes but includes a valid signature from the trusted IdP certificate, effectively bypassing authentication controls and allowing login as any user.
Potential Impact
Successful exploitation results in complete compromise of user authentication, allowing attackers to impersonate arbitrary users without valid credentials. This leads to full confidentiality, integrity, and availability impact on the affected Rocket.Chat instance.
Mitigation Recommendations
Fixed versions are 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, 8.6.1, and 8.7.0. Users should upgrade to these or later versions to remediate the vulnerability. No patch links were provided in the data, so users should consult official Rocket.Chat advisories for exact upgrade instructions. Since this is not a cloud service, remediation depends on user action.
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind… (CVE-2026-58066)
Description
Rocket.Chat versions prior to 7.10.14 and various 8.x releases did not properly bind verified XML signatures to the corresponding SAML Response or Assertion. This flaw allowed an attacker to submit a wrapped SAML document containing forged identity attributes alongside a valid signature from a trusted identity provider, enabling unauthorized login as arbitrary users.
CVSS v3.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Rocket.Chat's SAML Single Sign-On implementation involves improper binding of XML signatures to the samlp:Response or saml:Assertion elements. Although the XML signatures were verified, the application failed to ensure that the validated signature corresponded to the actual SAML response or assertion being processed. This weakness permits an attacker to craft a wrapped SAML document that carries forged identity attributes but includes a valid signature from the trusted IdP certificate, effectively bypassing authentication controls and allowing login as any user.
Potential Impact
Successful exploitation results in complete compromise of user authentication, allowing attackers to impersonate arbitrary users without valid credentials. This leads to full confidentiality, integrity, and availability impact on the affected Rocket.Chat instance.
Mitigation Recommendations
Fixed versions are 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, 8.6.1, and 8.7.0. Users should upgrade to these or later versions to remediate the vulnerability. No patch links were provided in the data, so users should consult official Rocket.Chat advisories for exact upgrade instructions. Since this is not a cloud service, remediation depends on user action.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f3wj-pr2w-q3fm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58066"]
- Ecosystems
- []
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.0
Threat ID: 6a6b72c69c2644c7f8475524
Added to database: 07/30/2026, 15:50:30 UTC
Last enriched: 07/30/2026, 19:39:49 UTC
Last updated: 07/31/2026, 03:12:02 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.