CVE-2026-28514: Rocket.Chat Auth Bypass Vulnerability

CVE-2026-28514 Overview

CVE-2026-28514 is a critical authentication bypass vulnerability in Rocket.Chat, an open-source, secure, and fully customizable communications platform. The vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service, allowing an attacker to log in to the service as any user with a password set, using any arbitrary password. This flaw stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result.

Critical Impact

This vulnerability allows complete account takeover of any user whose username is known or guessable, bypassing all password authentication controls through exploitation of an asynchronous code handling flaw.

Affected Products

• Rocket.Chat versions prior to 7.8.6
• Rocket.Chat versions prior to 7.9.8
• Rocket.Chat versions prior to 7.10.7
• Rocket.Chat versions prior to 7.11.4
• Rocket.Chat versions prior to 7.12.4
• Rocket.Chat versions prior to 7.13.3
• Rocket.Chat versions prior to 8.0.0

Discovery Timeline

• 2026-03-06 - CVE-2026-28514 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-28514

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287) resides in Rocket.Chat's account service within the ddp-streamer micro service. The core issue is a missing await keyword in the asynchronous password validation logic. When an asynchronous function is called without the await keyword, JavaScript returns a Promise object instead of waiting for the actual result. Since Promise objects are always truthy in JavaScript, the authentication check incorrectly evaluates to true regardless of whether the provided password is correct.

This flaw enables attackers to authenticate as any user account that has a password configured, simply by knowing or guessing the target username. The vulnerability is network-accessible and requires no prior authentication or user interaction, making it particularly dangerous in internet-facing Rocket.Chat deployments.

Root Cause

The root cause is a missing await keyword in the password validation code path within the ddp-streamer micro service's account authentication logic. When the asynchronous password comparison function is called without await, the code evaluates the Promise object itself (which is truthy) rather than the resolved boolean result of the password validation. This effectively bypasses all password checking, treating every password as valid.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can exploit this vulnerability through the following mechanism:

1. The attacker identifies a target username on the Rocket.Chat instance (usernames may be enumerable or guessable)
2. The attacker initiates a login request through the ddp-streamer service with the target username and any arbitrary password
3. The vulnerable authentication code fails to await the password validation Promise
4. The Promise object evaluates as truthy, bypassing password verification
5. The attacker gains full access to the target user's account

The vulnerability mechanism involves an asynchronous password validation function that returns a Promise. When the calling code fails to use the await keyword, JavaScript evaluates the Promise object itself rather than waiting for its resolved value. Since all objects (including Promise objects) are truthy in JavaScript, the authentication check passes regardless of the actual password validity. For technical implementation details, see the GitHub Commit Update and GitHub Security Advisory.

Detection Methods for CVE-2026-28514

Indicators of Compromise

• Multiple successful login events for the same user account from different IP addresses or unusual geographic locations
• Authentication logs showing successful logins without corresponding valid password hashes being compared
• Abnormal user session activity following authentication events, particularly from previously unseen IP addresses
• Sudden access to sensitive channels or data by accounts that typically don't access such resources

Detection Strategies

• Monitor authentication logs for anomalous login patterns, particularly multiple successful authentications for single accounts from diverse sources
• Implement alerting on login events from unexpected geographic locations or IP ranges
• Review ddp-streamer service logs for unusual authentication traffic patterns
• Deploy web application firewall (WAF) rules to detect and alert on brute-force login attempts targeting known usernames

Monitoring Recommendations

• Enable verbose logging for the ddp-streamer micro service authentication events
• Configure SIEM rules to correlate authentication events with subsequent suspicious user activity
• Monitor for enumeration attempts targeting user directories or contact lists
• Implement anomaly detection for user behavior following authentication events

How to Mitigate CVE-2026-28514

Immediate Actions Required

• Upgrade Rocket.Chat to patched versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, or 8.0.0 immediately
• Review authentication logs for signs of exploitation prior to patching
• Consider temporarily restricting access to the Rocket.Chat instance to trusted networks until patching is complete
• Force password resets for sensitive accounts, particularly administrative users

Patch Information

Rocket.Chat has released security patches in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0. The fix adds the missing await keyword to properly handle the asynchronous password validation function, ensuring the actual boolean validation result is evaluated. Review the GitHub Pull Request for implementation details and the GitHub Commit Update for the specific code changes.

Workarounds

• Implement network-level access controls to restrict Rocket.Chat access to trusted IP ranges only
• Enable multi-factor authentication (MFA) for all user accounts to add an additional authentication layer
• Consider placing the Rocket.Chat instance behind a VPN until patches can be applied
• Disable external access to the ddp-streamer service if possible without breaking required functionality

# Example: Restrict Rocket.Chat access to trusted networks using iptables
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP