CVE-2026-58066: Rocket.Chat SAML SSO Auth Bypass Flaw

CVE-2026-58066 Overview

CVE-2026-58066 is a critical authentication bypass in Rocket.Chat's Security Assertion Markup Language (SAML) single sign-on (SSO) implementation. The flaw allows attackers to log in as any user by submitting a wrapped SAML document containing forged identity attributes alongside a valid Identity Provider (IdP) signature. Rocket.Chat verified the XML signature but failed to bind that signature to the samlp:Response or saml:Assertion element being processed. The issue is classified as Improper Authentication [CWE-287].

Critical Impact
Unauthenticated attackers with any valid signed SAML document from the trusted IdP can impersonate arbitrary users, including administrators, without user interaction.

Affected Products

Rocket.Chat versions prior to 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7
Rocket.Chat versions prior to 8.2.7, 8.1.7, 8.0.8
Rocket.Chat versions prior to 7.10.14

Discovery Timeline

2026-07-30 - CVE-2026-58066 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58066

Vulnerability Analysis

The vulnerability is a classic XML Signature Wrapping (XSW) attack against SAML SSO. Rocket.Chat validated that a signature over some element in the submitted document was cryptographically valid, but did not confirm that the signed element was the same samlp:Response or saml:Assertion used to derive the authenticated identity. An attacker can wrap a legitimately signed assertion inside a crafted document that also contains a forged assertion. The signature check passes on the original element while the application reads user attributes from the attacker-controlled element.

Because SAML assertions convey identity (NameID), group membership, and role claims, an attacker who lands a forged identity value effectively logs in as that user. Any prior valid SAML response from the trusted IdP, such as one captured from the attacker's own login, is sufficient material for the wrapped payload.

Root Cause

The root cause is a failure to bind signature validation to the specific XML element consumed downstream. The signed reference and the parsed assertion are not required to be the same node, permitting parser and validator disagreement, which is the enabling condition for XSW.

Attack Vector

An unauthenticated attacker sends a crafted SAML POST binding response to the Rocket.Chat Assertion Consumer Service. The payload contains one valid signed assertion issued by the trusted IdP and an additional forged assertion carrying the target user's NameID or email attribute. Rocket.Chat validates the genuine signature, then extracts identity attributes from the forged assertion and issues a session for the impersonated account.

For technical details, see the Rocket.Chat GitHub Pull Request #41233 and the HackerOne Report #3827674.

Detection Methods for CVE-2026-58066

Indicators of Compromise

SAML responses containing multiple saml:Assertion elements or duplicate samlp:Response nodes submitted to the Rocket.Chat ACS endpoint.
Login events where the authenticated NameID does not match the IdP session that produced the referenced signature.
New administrator or privileged user sessions from IP addresses without prior IdP interaction.

Detection Strategies

Inspect reverse proxy or web application firewall logs for SAML payloads whose byte size or nesting depth deviates significantly from IdP norms.
Correlate Rocket.Chat authentication logs with IdP-side SSO issuance logs and alert on Rocket.Chat logins lacking a matching IdP assertion issuance.
Enable and review Rocket.Chat audit logs for unexpected role changes, admin logins, and API tokens created immediately after SSO events.

Monitoring Recommendations

Alert on privileged account logins occurring outside of business hours or from atypical geolocations.
Monitor for creation of personal access tokens or integrations shortly after SAML login events.
Track SAML response validation errors and warnings emitted by the Rocket.Chat SAML module to surface probing activity.

How to Mitigate CVE-2026-58066

Immediate Actions Required

Upgrade Rocket.Chat to a fixed release: 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, or 7.10.14.
Rotate SAML signing trust configuration and invalidate active sessions after upgrading.
Audit administrator accounts, integrations, and API tokens for unauthorized changes created before the patch was applied.

Patch Information

The fix is delivered in the versions listed above and is tracked in Rocket.Chat Pull Request #41233. The patch binds signature validation to the specific samlp:Response and saml:Assertion nodes that supply identity data, defeating wrapping payloads.

Workarounds

Temporarily disable the SAML SSO authentication provider and require password or alternative authentication until the upgrade is complete.
Restrict access to the Rocket.Chat Assertion Consumer Service endpoint to trusted network ranges using a reverse proxy or WAF.
Enforce IdP-side conditional access policies, such as device compliance and network location, to reduce the pool of valid signed assertions attackers could reuse.

bash

# Configuration example: disable SAML provider via Rocket.Chat admin API until patched
curl -H "X-Auth-Token: $ADMIN_TOKEN" -H "X-User-Id: $ADMIN_ID" \
  -H "Content-Type: application/json" \
  -X POST https://chat.example.com/api/v1/settings/SAML_Custom_Default \
  -d '{"value": false}'