Rocket.Chat CVE-2026-46423

Exploitation requires that SAML single sign-on is enabled in Rocket.Chat AND that the IdP certificate field is empty - the latter being the shipped default state of the setting, so no active misconfiguration is needed beyond turning SAML on. The specific trigger is the verifySignatures routine's early return when serviceProviderOptions.cert is falsy, which disables both SAML Response and Assertion signature checks. The key limiting factor is that the instance must have SAML enabled and reachable; deployments that do not use SAML, or that have a valid IdP certificate populated in the configuration, are not exploitable via this fail-open path. No authentication or user interaction is required (PR:N/UI:N) once SAML is enabled with the empty-cert default.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) scores 9.3 Critical and is consistent with the description: a network-reachable, unauthenticated, low-complexity authentication bypass yielding high confidentiality and integrity impact (full account/identity takeover) and limited availability impact. The decisive aggravating factor is that the vulnerable branch is reached with no misconfiguration beyond leaving the certificate field at its default, so realistic exploitability is higher than a typical 'requires non-standard config' SAML bug. Mitigating the urgency, there is no public exploit code identified and the CVE is not in CISA KEV, and no EPSS score was provided, so widespread automated exploitation is not currently evidenced. Note a data conflict: the source tags list 'Denial Of Service' and 'Jwt Attack', neither of which matches the actual SAML signature-verification authentication bypass described - the tags appear inaccurate and should not drive triage; the CWE-347 / SAML auth-bypass framing is authoritative.

An attacker discovers a Rocket.Chat instance with SAML enabled but no IdP certificate configured (the default) and sends a crafted, unsigned SAML assertion to the SAML login endpoint asserting the identity of a target user, such as an administrator. Because signature validation is skipped, Rocket.Chat accepts the forged assertion and grants an authenticated session as that user. The CVSS network vector and low attack complexity (AV:N/AC:L/PR:N/UI:N) mean this can be done remotely without authentication or user interaction; no public PoC was identified at time of analysis.