EUVD-2026-25129
GHSA-h257-f28j-hfjg
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
NoSQL injection in Rocket.Chat before 8.3.0 (and the 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9 maintenance releases) lets remote unauthenticated attackers take over the account of the first user holding a generated OAuth token when the built-in OAuth2 server has an app configured. The unsanitized access_token query parameter is passed into a MongoDB lookup, so operator injection (e.g. access_token[$ne]=null) matches a valid token without knowing it, authenticating the attacker as that user — typically the initial admin. There is no public exploit identified at time of analysis, though the fixing pull request and its regression tests openly disclose the exact injection payloads; EPSS is very low (0.01%, 3rd percentile) and CISA SSVC records no observed exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Rocket Chat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (hackerone) · only source for this CVE.
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured.
Executive ViewAI
Rocket.Chat versions before 8.3.0 contain a critical unauthenticated NoSQL injection vulnerability in the OAuth2 authentication module that allows attackers to impersonate the first user account (typically the initial administrator) without credentials. Organizations with OAuth2 enabled face immediate risk of complete system compromise through administrative account takeover.
Within 24 hours, disable the OAuth2 server in Rocket.Chat administration settings if not actively in use, or restrict network access to OAuth2 endpoints via firewall/WAF rules to whitelisted trusted applications only; simultaneously identify all Rocket.Chat instances with OAuth2 configured. Within 7 days, review authentication audit logs for suspicious token-based access patterns, particularly access_token parameters containing NoSQL operators (e.g., $ne, $gt, $regex); enable enhanced logging on OAuth2 authentication attempts. Within 30 days, monitor Rocket.Chat security advisories for patched versions (8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, 7.10.9, or later) and execute immediate upgrade upon vendor release; until patched, maintain strict network segmentation and access controls on OAuth2 endpoints.
Disable OAuth2 server if not in active use; implement firewall/WAF rules restricting OAuth2 endpoint access to known trusted client IPs only; deploy reverse proxy with input validation to reject access_token parameters containing NoSQL operator syntax ($ne, $gt, $nin, $regex, etc.); enable comprehensive audit logging on all authentication and OAuth2 token events; segment Rocket.Chat infrastructure on isolated network segment pending patch availability; consider temporarily disabling external user federation features that depend on OAuth2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Rocket Chat
View allA sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentic
A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retriev
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. Rated high sev
Rocket.Chat versions prior to 6.12.0 expose the OAuth applications API endpoint to any authenticated user, allowing disc
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed ema
An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with ph
A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth token
An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server meth
Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. Rated medium severity
A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pastin
Exploit-DB