Which versions of Rocket.Chat are affected by EUVD-2026-39095?

Rocket.Chat installations using SAML authentication face critical account takeover risk when the identity provider certificate is left unconfigured-the default deployment state.. A patch is available.

How to fix or mitigate EUVD-2026-39095?

Within 24 hours: Verify your Rocket.Chat version and audit SAML configuration to confirm whether the identity provider certificate field is populated (empty indicates vulnerability). Despite no public exploit identified at time of analysis, the CRITICAL severity and default configuration exposure warrant urgent action. Within 7 days: Upgrade to the appropriate patched version for your release branch: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11. Within 30 days: Verify post-upgrade that SAML signature validation functions correctly and review authentication logs for suspicious account access during the vulnerability window.

Rocket.Chat EUVD-2026-39095

Q: What is the CVSS score of EUVD-2026-39095?

EUVD-2026-39095 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-46423 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-24 security-advisories@github.com

Denial Of Service Jwt Attack

9.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Network-reachable, low-complexity, unauthenticated SAML signature bypass enabling full identity/account takeover, so PR:N with high confidentiality and integrity and limited availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Analysis Generated

Jun 24, 2026 - 21:39 vuln.today

DescriptionCVE.org

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML service provider implementation silently skips both SAML Response and Assertion signature validation when the configured IdP certificate field is empty. The verifySignatures routine performs an early return when serviceProviderOptions.cert is falsy, which is the default state of the setting. Because provider registration only gates on the SAML "enabled" toggle and not on the presence of a certificate, an administrator who enables SAML without pasting an IdP certificate obtains a fully wired, publicly reachable SAML login endpoint that accepts unsigned or attacker-supplied assertions. This is a default-configuration authentication-bypass class: the fail-open branch is reached with no misconfiguration beyond leaving a field at its shipped default. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

AnalysisAI

Authentication bypass in Rocket.Chat's SAML service provider lets attackers log in as arbitrary users when SAML is enabled but the IdP certificate field is left at its empty shipped default, which causes signature validation to be silently skipped. All versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11 are affected, and the CVSS 4.0 base score is 9.3 (Critical). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the fail-open behavior is reachable in a near-default configuration, making it a high-priority fix.

Technical ContextAI

The flaw is in Rocket.Chat's SAML 2.0 single sign-on implementation, where the service provider validates the cryptographic signatures of SAML Responses and Assertions to ensure they were issued by the trusted Identity Provider (IdP). CWE-347 (Improper Verification of Cryptographic Signature) is the root cause: the verifySignatures routine performs an early return when serviceProviderOptions.cert is falsy, so when no IdP certificate is configured, both the Response-level and Assertion-level signature checks are skipped entirely. Critically, SAML provider registration is gated only on the SAML 'enabled' toggle and not on the presence of a certificate, so enabling SAML exposes a fully wired, publicly reachable login endpoint that trusts unsigned or attacker-forged assertions. The empty certificate field is the shipped default, so this is a fail-open default-configuration weakness rather than something requiring active misconfiguration.

RemediationAI

Vendor-released patch: upgrade to the fixed release for your branch - 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11 (choose the patched version matching your current major/minor line) per advisory GHSA-rgg7-qvp9-wvx7 (https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-rgg7-qvp9-wvx7). As an immediate compensating control before patching, either disable SAML authentication entirely (trade-off: SSO logins stop working and users must use other configured login methods), or, if SAML must remain enabled, paste the correct IdP signing certificate into the certificate field so the verifySignatures routine no longer hits its fail-open early return (trade-off: requires the legitimate IdP cert and correct configuration, and real-IdP assertions must be properly signed). Additionally restrict network access to the SAML login endpoints to trusted networks where feasible to reduce exposure of the publicly reachable endpoint until the upgrade is applied.