CVE Intelligence
Analysis AI-assisted

CVE-2026-45688: Rocket.Chat CAS Login NoSQL Injection Enabling Session Token Issuance

Rocket.Chat versions before the listed fixed releases contain a NoSQL injection flaw in the CAS login handler, rated critical by GitHub Security Advisories with CVSS 3.1 score 9.1. According to the record, an unauthenticated attacker may obtain a valid authentication token for a user who is logging in through CAS or SAML SSO at the same time, and an administrator victim could lead to full instance compromise. Upgrading to a fixed release is the primary remediation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Rocket.Chat releases before the fixed versions contain a NoSQL injection weakness in the CAS login handler, which the record maps to CWE-943. The CNA, GitHub Security Advisories, scores the issue critical with a CVSS 3.1 base score of 9.1 and a network attack vector requiring no privileges or user interaction.

Impact

According to the record, an unauthenticated attacker can bypass the CAS ticket check and obtain a Meteor authentication token bound to a user who is logging in through CAS or SAML SSO at the same time. The record states that such a token can be used against the REST and DDP interfaces as that user. If the targeted user is an administrator, the record says the attacker could reach full instance compromise through Apps-Engine app installation. The CVSS vector rates confidentiality and integrity impact as high and availability impact as none.

Affected products and versions

  • Product: Rocket.Chat, the open-source communications platform.
  • Versions described as vulnerable: releases prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 and 7.10.11.
  • Fixed versions listed in the record: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 and 7.10.11.
  • The structured affected list in the record is empty, so the exact mapping of each fixed version to its release branch is unknown from the available data. Check the GitHub advisory for the authoritative per-branch details.

Exploitation status

The CISA KEV catalog does not list this CVE in the data available, and no confirmed exploitation appears in the sources consulted. The record contains no EPSS score.

Remediation and mitigation

  • Upgrade Rocket.Chat to the fixed release for your release branch as listed above.
  • Until the upgrade is complete, reduce exposure by limiting who can reach the CAS and SAML login endpoints where your deployment allows it, and review whether SSO is required for your instance.
  • Review administrator accounts and their recent activity, and rotate credentials for accounts that may have been affected, following your internal incident procedures.
  • The consulted record does not describe a vendor workaround. Consult the GitHub advisory for any additional guidance.

Detection guidance

  • Review authentication logs for unusual or unexpected CAS or SAML login sequences, particularly login attempts that do not match a user's normal activity.
  • Look for unexpected session or token creation for administrator accounts and for access from unfamiliar sources shortly after SSO logins.
  • Audit recent installations of Apps-Engine apps and changes to administrative settings, since the record identifies app installation as the escalation path for administrators.
  • Treat these indicators as starting points for investigation rather than confirmed evidence of compromise.

Limitations of the available information

  • The record is based on a GitHub Security Advisory description and has no structured affected or fixed product data.
  • The CWE name, EPSS, SSVC and KEV details are absent or empty in the record.
  • The NVD source status is listed as Deferred.
  • No independent proof of concept, vendor test result or exploitation report was consulted, so the description is reported as stated by the source.

Frequently asked questions

What is CVE-2026-45688?

It is a NoSQL injection weakness in the CAS login handler of Rocket.Chat, classified as CWE-943 and rated critical with CVSS 3.1 score 9.1 by GitHub Security Advisories.

Which versions are fixed?

The record lists fixed versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 and 7.10.11. Check the advisory to confirm which fixed version applies to your release branch.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list it in the data available, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.