CVE-2026-58066CWE-287

CVE-2026-58066

Critical · published July 30, 2026

CVSS v3.0
9.8
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

The record
Technical detail
CVSS v3.0
9.8 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-07-30T10:25Z
Affected products (8)
ProductVersionsFixed in
rocket.chat/rocket.chat< 7.10.147.10.14
rocket.chat/rocket.chat≥ 8.0.0, < 8.0.88.0.8
rocket.chat/rocket.chat≥ 8.1.0, < 8.1.78.1.7
rocket.chat/rocket.chat≥ 8.2.0, < 8.2.78.2.7
rocket.chat/rocket.chat≥ 8.3.0, < 8.3.78.3.7
rocket.chat/rocket.chat≥ 8.4.0, < 8.4.58.4.5
rocket.chat/rocket.chat≥ 8.5.0, < 8.5.28.5.2
rocket.chat/rocket.chat≥ 8.6.0, < 8.6.18.6.1
References (2)
https://github.com/RocketChat/Rocket.Chat/pull/41233 · [email protected]https://hackerone.com/reports/3827674 · [email protected]
EPSS history
Timeline
  • 30 JUL 06:03Z
    Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the…
    cvelistv5