CVE-2026-58066

CriticalCVSS 9.8/10Last modified Aug 25, 2026

Description

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Rocket.Chat	Rocket.Chat	< 8.7.0; < 8.6.1; < 8.5.2; < 8.4.5; < 8.3.7; < 8.2.7; < 8.1.7; < 8.0.8; < 7.10.14

References

https://github.com/RocketChat/Rocket.Chat/pull/41233Issue Tracking
https://hackerone.com/reports/3827674Third Party Advisory, Issue Tracking

Timeline

Published: Jul 30, 2026
Last modified: Aug 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-580678.7A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.CVE-2026-580686.8This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.CVE-2026-580698.3This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provide CVE-2026-58077.5Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generati CVE-2026-580706.8A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to CVE-2026-580718.2A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administ CVE-2026-580729.0A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execu CVE-2026-580739.5A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's CVE-2026-580748.6A vulnerability allowing a high-privileged user to execute arbitrary code on the server.CVE-2026-580758.7A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privil CVE-2026-580768.8Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized bl CVE-2026-580778.7Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unaut