Which versions of Rocket.Chat are affected by CVE-2026-55666?

Rocket.Chat instances using Apple Sign-In authentication are vulnerable to account takeover attacks that require no user interaction or credentials.. A patch is available.

How to fix or mitigate CVE-2026-55666?

Within 24 hours: Disable Apple Sign-In in Rocket.Chat authentication settings and communicate alternate login methods to users, or restrict Rocket.Chat access to internal networks only if Apple authentication is operationally required. Within 7 days: Monitor Rocket.Chat security releases and vendor advisories for patch availability; audit Rocket.Chat user database for suspicious Apple-authenticated accounts created since early June 2026; enable audit logging if not already active. Within 30 days: Deploy patched versions once available (Rocket.Chat 8.5.1 or corresponding patches for 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.10.13); validate patch deployment in production; perform access review of accounts created during vulnerability window.

Rocket.Chat CVE-2026-55666

Q: What is the CVSS score of CVE-2026-55666?

CVE-2026-55666 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39119 CRITICAL

Improper Authentication (CWE-287)

2026-06-24 GitHub_M

Authentication Bypass Apple Rocket Chat Rocketchat

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, low-complexity, unauthenticated forging of an Apple JWT with no user interaction yields full account takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 23:03 EUVD

Analysis Generated

Jun 24, 2026 - 22:15 vuln.today

CVE Published

Jun 24, 2026 - 21:06 cve.org

CRITICAL 9.3

DescriptionCVE.org

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an email parameter. If the JWT does not contain an email address, the application falls back to accepting an arbitrary email value supplied directly in the request. Attackers are able to forge Apple JWTs that do not contain an email address and leverage this vulnerability to carry out account takeover attacks. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

AnalysisAI

Authentication bypass leading to account takeover in Rocket.Chat affects the Apple Sign-In OAuth flow prior to versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13. The handleIdentityToken function in the Apple login handler falls back to trusting an attacker-supplied email value when the Apple-issued JWT omits an email claim, so a remote unauthenticated attacker can forge an email-less Apple JWT and log in as any victim by their email address. No public exploit is identified at time of analysis, but the CVSS 4.0 base score of 9.3 (critical) and trivial exploitation conditions make this a high priority for any instance with Apple login enabled.

Technical ContextAI

Rocket.Chat is an open-source team-communications platform (cpe:2.3:a:rocketchat:rocket.chat). The flaw lives in apps/meteor/app/apple/server/loginHandler.ts, which implements 'Sign in with Apple' OAuth. During this flow Apple issues a signed JWT (identity token) that normally carries the authenticated user's email. The vulnerable handleIdentityToken logic checks the JWT for an email claim, and when that claim is absent it does not reject the request - instead it accepts an email value passed directly in the request body. This maps to CWE-287 (Improper Authentication): the application uses an untrusted, client-controlled identifier to establish identity instead of binding the session strictly to the cryptographically verified claims inside the Apple-signed token. Because Apple legitimately can issue tokens without an email (e.g., when a user hides their email or on subsequent logins), an attacker can craft or obtain a valid-but-email-less token and then assert any email they choose.

RemediationAI

Vendor-released patch: upgrade to the fixed release on your branch - 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13 (choose the one matching your current major/minor line). Details are in the advisory at https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-wx3c-76rf-wpwf. If you cannot patch immediately, the most direct compensating control is to disable the 'Sign in with Apple' OAuth provider in the Rocket.Chat admin settings, which removes the vulnerable code path entirely at the cost of blocking legitimate Apple logins until you upgrade. Where Apple login must remain available, restrict administrative access and audit recently created or modified accounts and login events for anomalous logins tied to Apple OAuth, recognizing this is detection rather than prevention. After upgrading, review accounts for signs of prior takeover and consider forcing credential and session resets for affected users.