CVE Intelligence
Analysis AI-assisted

CVE-2026-55666: Rocket.Chat: improper authentication in Apple OAuth login

Rocket.Chat versions before the fixed releases can accept an email address supplied in the request when the Apple identity token does not contain one, which the advisory links to account takeover. The CNA rates the issue critical with CVSS 4.0 score 9.3, and the CWE is CWE-287 (Improper Authentication). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Rocket.Chat is an open-source communications platform. According to the GitHub Security Advisory tied to this CVE, the Apple OAuth login handler in apps/meteor/app/apple/server/loginHandler.ts can accept an email value supplied directly in the request when the Apple identity token carries no email address. The weakness is classified as CWE-287 (Improper Authentication).

Impact

  • The advisory describes the consequence as account takeover.
  • The CNA-assigned CVSS 4.0 base score is 9.3 (critical), with network attack vector, no privileges required, no user interaction, and high confidentiality, integrity and availability impact on the vulnerable system.
  • The record describes the trigger only in general terms: tokens lacking an email address are the condition that enables the fallback.

Affected products and versions

  • Product: Rocket.Chat.
  • The description states that versions prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7 and 7.10.13 are affected, and that the fix is in those versions.
  • The structured affected list is empty, so the exact affected range within each release branch is unknown from the record.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record, so active exploitation is not confirmed.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade Rocket.Chat to the fixed release for your branch: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7 or 7.10.13.
  • If an upgrade cannot be applied immediately, consider temporarily disabling Apple sign-in where it is not operationally required. This is a general defensive suggestion and is not stated in the advisory.
  • Consult the vendor advisory GHSA-wx3c-76rf-wpwf for official guidance.

Detection guidance

  • Review authentication logs for Apple-based sign-ins, particularly sessions where the associated account email does not match the identity provider's data.
  • Monitor for unexpected email changes, password resets or new sessions on accounts that use Apple sign-in.
  • Correlate authentication events with user reports of account activity they did not initiate.

Limitations of the available information

  • The structured record contains no affected or fixed version fields; version data comes from the description text.
  • The record does not reference public proof-of-concept code or exploitation telemetry.
  • No CISA ADP, SSVC or EPSS data is present in the record.
  • The record does not state whether the CVSS vector reflects a deployment with Apple login enabled by default.

Frequently asked questions

What is CVE-2026-55666?

It is a critical improper authentication issue in Rocket.Chat's Apple OAuth login handling. When the Apple token lacks an email address, the application falls back to an email value supplied in the request, which the advisory links to account takeover.

Which versions are fixed?

According to the record description, the fixed versions are 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7 and 7.10.13. The structured affected-version list is empty, so check your release branch against these fixes.

Is this vulnerability being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted for this analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.