CVE-2026-55759: Rocket.Chat Auth Bypass Vulnerability

CVE-2026-55759 Overview

CVE-2026-55759 is an authentication bypass vulnerability in Rocket.Chat, an open-source communications platform. The Apple Sign-In handler verifies the JSON Web Token (JWT) signature but skips claims validation. Any Apple-signed JWT with a non-empty iss claim is accepted regardless of aud, exp, nbf, or nonce values. An attacker who obtains a target user's Apple identity token can replay it to authenticate as that user, with no expiration on the replay window. The flaw is tracked under [CWE-287] Improper Authentication.

Critical Impact
Attackers can replay stolen Apple identity tokens indefinitely to impersonate any Rocket.Chat user that signed in with Apple.

Affected Products

Rocket.Chat versions prior to 8.5.1 in the 8.5.x branch
Rocket.Chat versions prior to 8.4.4, 8.3.6, 8.2.6, 8.1.6, and 8.0.7 in the 8.x branches
Rocket.Chat versions prior to 7.10.13 in the 7.10.x branch

Discovery Timeline

2026-06-24 - CVE-2026-55759 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-55759

Vulnerability Analysis

The vulnerability resides in the Sign in with Apple authentication handler within Rocket.Chat. Apple's identity tokens are signed JWTs that carry standard claims such as iss (issuer), aud (audience), exp (expiration), nbf (not before), and nonce. A compliant verifier must check all of these claims against expected values. Rocket.Chat's handler validates only the cryptographic signature against Apple's public keys and confirms the iss claim is non-empty. It does not enforce that aud matches the configured Apple client identifier, does not enforce expiration, and does not bind the token to a session-specific nonce.

As a result, any token signed by Apple becomes a permanently valid authenticator for the user identified in the sub claim. The attack succeeds entirely through the network authentication endpoint and requires no interaction from the victim once a token has been captured.

Root Cause

The root cause is missing claims validation after JWT signature verification. The handler trusts Apple's signature as sufficient proof of authenticity, ignoring that JWT semantics require validation of issuer, audience, expiration, and replay-protection claims. This is a classic implementation gap in OpenID Connect-style identity token verification.

Attack Vector

An attacker first obtains a target user's Apple identity token. Sources include server logs that captured the token during a prior sign-in, network interception of an in-flight authentication request, or a separate application that shares the same Apple developer team and therefore receives tokens with a compatible aud. The attacker then submits the token to Rocket.Chat's Apple Sign-In endpoint. The handler verifies the signature, accepts the non-empty iss, and issues a Rocket.Chat session for the user identified in the token. Because expiration is not enforced, the token remains usable indefinitely.

No verified exploit code is publicly available. See the GitHub Security Advisory for vendor technical detail.

Detection Methods for CVE-2026-55759

Indicators of Compromise

Successful Apple Sign-In authentication events for a single user originating from multiple geographically or temporally inconsistent IP addresses.
Apple Sign-In sessions established using identity tokens whose iat or implied issuance time is older than a few minutes.
Repeated Apple Sign-In requests for the same sub claim within short intervals, suggesting token reuse.

Detection Strategies

Enable verbose authentication logging on Rocket.Chat and capture the Apple identity token's aud, iat, and sub claims for every login attempt.
Correlate Apple Sign-In events with user-agent and source IP baselines to flag impersonation attempts.
Alert when the aud claim of a presented token does not match the Rocket.Chat instance's configured Apple Services ID.

Monitoring Recommendations

Forward Rocket.Chat authentication logs to a centralized SIEM for retention and correlation across identity providers.
Track session creation rates for Apple Sign-In users and trigger alerts on anomalous spikes.
Monitor administrative accounts authenticated through Apple Sign-In with elevated scrutiny until patches are applied.

How to Mitigate CVE-2026-55759

Immediate Actions Required

Upgrade Rocket.Chat to a fixed release: 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13, depending on the deployed branch.
Invalidate active sessions for users who authenticated through Apple Sign-In prior to applying the patch.
Rotate any Apple Services ID and Sign in with Apple keys that may have appeared in server logs or shared application contexts.

Patch Information

Rocket.Chat addressed CVE-2026-55759 in versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13. The fix enforces validation of the aud, exp, nbf, and nonce claims after signature verification. Patch details are published in the Rocket.Chat GitHub Security Advisory GHSA-c75c-5hc7-j4vp.

Workarounds

Disable the Sign in with Apple authentication provider in the Rocket.Chat administration console until the instance is upgraded.
Restrict authentication to providers that perform complete OpenID Connect claims validation, such as a properly configured SAML or OAuth provider.
Scrub historical server logs to remove captured Apple identity tokens and tighten log access controls to reduce future exposure.

bash

# Disable Apple Sign-In via the Rocket.Chat administration API
curl -X POST "https://chat.example.com/api/v1/settings/Accounts_OAuth_Apple" \
  -H "X-Auth-Token: $ADMIN_TOKEN" \
  -H "X-User-Id: $ADMIN_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"value": false}'