CVE-2026-45689: Rocket.Chat Auth Bypass Vulnerability

CVE-2026-45689 Overview

CVE-2026-45689 is a NoSQL injection vulnerability in the Rocket.Chat OAuth2 server that allows unauthenticated network attackers to mint valid OAuth access tokens for arbitrary users. The flaw resides in the /oauth/token endpoint, which forwards grant parameters directly to MongoDB findOne({...}) queries without validating that the values are strings. An attacker submits MongoDB operators such as {"$ne": null} in place of client_id, client_secret, and refresh_token to receive a fresh bearer token bound to the first matching user. Iterating with $nin and $regex operators walks the entire oauth_access_tokens collection. If a matched token belongs to an administrator, the attacker gains full admin API access, including Apps-Engine app installation that yields server-side code execution.

Critical Impact
Unauthenticated attackers can mint OAuth access tokens for any Rocket.Chat user, including administrators, leading to full server-side code execution via Apps-Engine.

Affected Products

Rocket.Chat versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11
Rocket.Chat OAuth2 server component (/oauth/token endpoint)
oauth_apps and oauth_access_tokens MongoDB collections

Discovery Timeline

2026-06-24 - CVE-2026-45689 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-45689

Vulnerability Analysis

The vulnerability is a NoSQL injection flaw classified as [CWE-943] (Improper Neutralization of Special Elements in Data Query Logic). The Rocket.Chat OAuth2 server accepts grant parameters from an HTTP POST request to /oauth/token and passes them directly to MongoDB findOne() queries against the oauth_apps and oauth_access_tokens collections.

Because the server does not enforce that client_id, client_secret, and refresh_token are strings, an attacker substitutes MongoDB query operators in their place. A payload such as {"$ne": null} matches any non-null document, causing the server to return the first OAuth application and the first refresh token in the collection. The server then mints a fresh {access_token, refresh_token} pair bound to whichever user owned that refresh token.

The resulting access token functions as a first-class bearer credential against the full /api/v1/* API surface as the impersonated user. Tokens belonging to administrators expose the Apps-Engine installation API, enabling server-side code execution.

Root Cause

The root cause is missing input type validation in the OAuth2 grant handler. The handler trusts client-supplied JSON values and forwards them unmodified to MongoDB query operators, allowing object payloads to be interpreted as query expressions rather than string equality checks.

Attack Vector

The attack vector is network-based and requires no authentication, credentials, user identifier, or prior interaction with the target instance. An attacker sends a single HTTP POST request to /oauth/token containing JSON-encoded MongoDB operators in the grant parameters. Iterating the request with $nin to exclude previously seen identifiers or $regex to filter by username allows the attacker to enumerate one fresh access token per user in the database.

The vulnerability is described in the Rocket.Chat GitHub Security Advisory. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-45689

Indicators of Compromise

POST requests to /oauth/token containing JSON object values such as {"$ne": null}, {"$nin": [...]}, or {"$regex": "..."} in the client_id, client_secret, or refresh_token parameters
Unexpected creation of new entries in the oauth_access_tokens collection from external IP addresses
API activity under /api/v1/* from bearer tokens that were never issued through a normal OAuth authorization flow
Installation of unknown or untrusted Apps-Engine applications by administrator accounts

Detection Strategies

Inspect web server and reverse proxy access logs for POST bodies to /oauth/token containing $ characters in grant parameter values
Correlate /oauth/token requests against authorization code issuance to identify token mints with no preceding authorization
Audit the oauth_access_tokens collection for tokens created within short time windows across many distinct users
Alert on Apps-Engine app installations not initiated from the administrative web console

Monitoring Recommendations

Forward Rocket.Chat application logs and reverse proxy logs to a centralized analytics platform for query-based hunting
Monitor MongoDB query logs for findOne operations on oauth_apps and oauth_access_tokens containing operator expressions
Track API call volume per bearer token to identify automated enumeration of /api/v1/* endpoints
Review administrator account activity for unexpected Apps-Engine, integration, or webhook changes

How to Mitigate CVE-2026-45689

Immediate Actions Required

Upgrade Rocket.Chat to a fixed release: 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11
Revoke all existing OAuth access tokens and refresh tokens after upgrading by clearing the oauth_access_tokens and oauth_refresh_tokens collections
Rotate administrator credentials and review administrator session activity since the vulnerable version was deployed
Audit installed Apps-Engine applications and remove any that were not explicitly authorized

Patch Information

Rocket.Chat released fixes in versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. The patch enforces string type validation on OAuth grant parameters before they are passed to MongoDB queries. Patch details are available in the Rocket.Chat GitHub Security Advisory GHSA-8p25-fm45-pjrw.

Workarounds

Place a reverse proxy or web application firewall in front of Rocket.Chat to reject POST requests to /oauth/token whose body contains MongoDB operator characters such as $ne, $nin, $regex, or $gt in parameter values
Restrict network access to the Rocket.Chat instance to trusted networks until the upgrade is applied
Temporarily disable the OAuth2 server feature if it is not in active use within the deployment

bash

# Example WAF rule fragment to block MongoDB operators in OAuth grant parameters
# Reject POST /oauth/token bodies containing $ne, $nin, $regex, or $gt operators
SecRule REQUEST_URI "@streq /oauth/token" \
    "chain,phase:2,deny,status:400,id:1004568,msg:'NoSQL operator in OAuth grant'"
    SecRule REQUEST_BODY "@rx \"\\$(ne|nin|regex|gt|lt|in|exists)\"\\s*:" "t:none"