CVE Intelligence
Analysis AI-assisted

CVE-2026-46423: Rocket.Chat SAML Signature Validation Bypass When IdP Certificate Is Empty

Rocket.Chat's SAML service provider skips both SAML Response and Assertion signature validation when the IdP certificate field is empty, which is the default setting. The record assigns CVSS 4.0 9.3 (critical) and CWE-347, and states the flaw is fixed in 8.5.0 and several other release lines. The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-46423 is a critical authentication bypass in the SAML service provider of Rocket.Chat. According to the record, SAML Response and Assertion signature checks are skipped when the IdP certificate field is empty, and that field is empty by default.

Impact

  • A remote party may be able to present unsigned or attacker-supplied SAML assertions to a publicly reachable SAML login endpoint.
  • The record scores the issue CVSS 4.0 9.3, with high confidentiality and integrity impact, low availability impact, and no privileges or user interaction required.
  • Successful abuse would bypass authentication, which could allow unauthorized access to workspace accounts.

Affected products and versions

  • Product: Rocket.Chat, SAML service provider feature.
  • The description states the flaw applies to releases prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 and 7.10.11.
  • The structured affected list in the record is empty, so exact affected ranges for each release line are unknown beyond this text.

Exploitation status

  • The record shows the issue is not listed in CISA KEV.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS and SSVC data are not present in the record.

Remediation and mitigation

  • Upgrade to the fixed release matching your line: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 or 7.10.11.
  • Until patching is complete, disable the SAML login feature if it is not required.
  • If SAML is required, configure the IdP certificate and confirm that only the intended identity provider configuration is accepted.
  • Review the upstream advisory: GitHub advisory GHSA-rgg7-qvp9-wvx7.

Detection guidance

  • Review SAML login logs for successful logins from unexpected accounts or unrecognized identity sources, especially on instances where SAML was enabled.
  • Audit the SAML configuration for an empty certificate field.
  • Check recent administrator and new-user creation events for anomalies.

Limitations of the available information

  • The record contains no exploit details, no proof-of-concept data and no indicators of compromise.
  • The record source status is Deferred.
  • No structured version-by-version mapping is provided.
  • The record does not state whether fixes were backported beyond the listed versions.

Frequently asked questions

Why is this vulnerability dangerous in default configurations?

According to the record, the certificate field is empty by default and the SAML feature only checks the enabled toggle, so enabling SAML without adding a certificate leaves the login endpoint without signature validation.

What should administrators do first?

Upgrade to the fixed release for your line (8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 or 7.10.11). If SAML is not needed, disable it until the upgrade is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.