CVE Intelligence
Analysis AI-assisted

CVE-2026-45689: Rocket.Chat OAuth2 token endpoint NoSQL operator injection enabling unauthenticated access token issuance

CVE-2026-45689 is a critical flaw in Rocket.Chat's OAuth2 token endpoint, where grant parameters are not validated as strings before being used in MongoDB queries. According to the GitHub advisory, an unauthenticated network attacker can obtain a valid access token bound to a user, and if that user is an administrator, the token grants broad administrative API access. The record gives a CVSS 3.1 base score of 9.1, lists fixed versions in the description, and shows no confirmed exploitation in the CISA KEV catalog.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-45689 affects the OAuth2 token endpoint of Rocket.Chat, an open-source communications platform. The root cause, as described in the record, is that request parameters used in authentication lookups are not checked to be plain strings before they are passed to MongoDB queries. This is classified as CWE-943, improper neutralization of special elements in data query logic.

Impact

The description states that an unauthenticated attacker on the network can obtain a valid access token for a user, without credentials or prior interaction. The resulting token is described as a bearer credential usable across the user's API surface. If the token belongs to an administrator, the advisory states that it allows full administrative API access, including installing Apps-Engine applications, which the record describes as server-side code execution. The record's CVSS 3.1 vector indicates high confidentiality and integrity impact with no availability impact.

Affected products and versions

  • Product: Rocket.Chat, per the GitHub advisory and the record description.
  • The description states the vulnerability is present before versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 and 7.10.11, and is fixed in those versions.
  • The structured affected and fixes fields in the record are empty, so the version ranges above come from the description text only.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. The EPSS score and SSVC data are not available in the record.

Remediation and mitigation

  • Upgrade Rocket.Chat to one of the fixed versions listed for the release line in use, as described in the GitHub advisory.
  • Where upgrading cannot happen immediately, reduce network exposure of the affected instance and restrict access to its authentication endpoints to trusted networks, as a general hardening measure. The record does not describe a vendor-supplied workaround.
  • After upgrading, review active sessions and API tokens, particularly those of administrator accounts, and revoke or rotate any that may have been issued without legitimate use.

Detection guidance

  • Review web server and application logs for unusual requests to the OAuth token endpoint, especially requests that are not followed by normal interactive login activity.
  • Look for token issuance for accounts that did not authenticate through the usual flow, and for API activity from administrator accounts originating from unexpected addresses.
  • Monitor for newly installed Apps-Engine applications or unexpected administrative configuration changes.

Limitations of the available information

The record does not include structured affected products, fixed version fields, EPSS, SSVC or KEV details beyond the listing status. The CNA and NVD severity values are both recorded as critical with a CVSS 3.1 score of 9.1. The source status is recorded as Deferred, and no vendor timeline or patch metadata beyond the advisory text is included.

Frequently asked questions

What is CVE-2026-45689?

It is a critical vulnerability in the OAuth2 token endpoint of Rocket.Chat, where request parameters are not validated as strings before being used in MongoDB queries. The record reports a CVSS 3.1 score of 9.1.

Which versions are fixed?

The record description states the fixes are in versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 and 7.10.11. The structured fixes field is empty, so these come from the description text.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.