What is the CVSS score of CVE-2026-55759?

CVE-2026-55759 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Rocket.Chat are affected by CVE-2026-55759?

Rocket.Chat's Apple Sign-In authentication handler contains a critical bypass vulnerability (CVE-2026-55759) allowing attackers to impersonate any user by replaying captured identity tokens without…. A patch is available.

How to fix or mitigate CVE-2026-55759?

Within 24 hours: inventory all Rocket.Chat deployments and identify versions currently in use; confirm whether Apple Sign-In authentication is enabled. Within 7 days: apply vendor patches to all affected instances-upgrade to version 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13 depending on your current branch. Within 30 days: audit authentication logs for the vulnerability window and review user sessions for any unauthorized access patterns; consider requesting Apple token re-authentication for affected users.

Rocket.Chat CVE-2026-55759

EUVD-2026-39120 HIGH

Improper Authentication (CWE-287)

2026-06-24 GitHub_M

Authentication Bypass Apple Rocket Chat

7.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable and unauthenticated to Rocket.Chat (PR:N), but AC:H because the attacker must first obtain a valid Apple token; full account takeover gives C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 24, 2026 - 23:03 EUVD

Analysis Generated

Jun 24, 2026 - 22:15 vuln.today

CVE Published

Jun 24, 2026 - 21:07 cve.org

HIGH 7.4

DescriptionCVE.org

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss is accepted regardless of aud, exp, nbf, or nonce. An attacker who obtains a target user's Apple identity token (from server logs, an intercepted sign-in flow, or another application sharing the same Apple developer team) can replay it to authenticate as that user, with no expiration on the replay window. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

AnalysisAI

Authentication bypass in Rocket.Chat's Apple Sign-In handler allows attackers to impersonate any user by replaying a captured Apple identity token. The handler verifies the JWT signature but skips validation of the aud, exp, nbf, and nonce claims, so any Apple-signed token with a non-empty iss is accepted indefinitely with no replay-window expiry. Affected versions are those prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-287 (Improper Authentication) in Rocket.Chat's 'Sign in with Apple' OAuth/OIDC integration. Sign in with Apple issues a signed JWT (identity token) where security depends on validating both the signature AND the registered claims: aud (audience, must equal the relying party's client/team ID), exp/nbf (token lifetime window), and nonce (binds the token to a specific authentication request to prevent replay). Rocket.Chat's handler validated only the cryptographic signature against Apple's public keys and confirmed iss was non-empty, but never checked aud, exp, nbf, or nonce. Because Apple signs all tokens for a given developer team with the same keys, any token legitimately minted for one application (or a sibling app on the same Apple developer team) carries a valid signature and is therefore accepted by Rocket.Chat as proof of identity. The affected product per CPE is cpe:2.3:a:rocketchat:rocket.chat across all versions prior to the fixed releases.

RemediationAI

Vendor-released patch: upgrade to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13 - choose the patched release matching your current minor branch, per the advisory at https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-c75c-5hc7-j4vp. If immediate upgrade is not possible, the most effective compensating control is to disable the Apple Sign-In authentication method in Rocket.Chat administration, which fully removes the vulnerable code path at the cost of blocking legitimate Apple-based logins. Additionally, audit and scrub server and proxy logs that may have captured Apple identity tokens and tighten log access, since leaked tokens are the primary attack input; if Apple login must remain enabled, also rotate the Apple Sign-In service/client configuration so previously issued tokens for unrelated apps cannot be reused. Note these are stopgaps - only the patched versions actually enforce aud/exp/nbf/nonce validation.