NoSQL injection authentication bypass in Rocket.Chat CAS login handler (CVE-2026-45688)

Rocket.Chat's CAS login handler passes the client-supplied `credentialToken` value directly into a MongoDB `findOne` query without runtime type validation, allowing an unauthenticated attacker to substitute MongoDB query operators (e.g., `{"$gt": ""}`) for the expected ticket string. This bypasses the CAS ticket check entirely and, when any legitimate CAS or SAML SSO login is active within the 60-second credential-token window, allows the attacker to obtain a full Meteor authentication token bound to the victim user. If the hijacked session belongs to an administrator, this results in full instance compromise via Apps-Engine application installation. Affected versions: - <8.5.0 - <8.4.1 - <8.3.3 - <8.2.3 - <8.1.4 - <8.0.5 - <7.13.7 - <7.10.11 We recommend updating to: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, 7.10.11. CVSS 9.1 · our assessment: act_now Reference: https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-rr54-jf4h-6cj9 Details: https://vuln.today/cve/CVE-2026-45688