Improper Authentication in Rocket.Chat - CVE-2026-55666
Published: November 9, 2026
Vulnerability identifier: #VU163158
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55666
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to take over other users' accounts on Rocket.Chat deployments using Apple OAuth.
The vulnerability exists due to Rocket.Chat's Apple OAuth login handler trusting a request-supplied email address when the identity token lacks an email claim. An unauthenticated remote attacker can submit a forged Apple identity token without an email claim alongside a victim's email address to authenticate as that victim.
Affected software
Rocket.Chat
How to mitigate CVE-2026-55666
Install security update from vendor's website.
Rocket.Chat - addressed in versions 7.10.13, 8.0.7, 8.1.6, 8.2.6, 8.3.6, 8.4.4, 8.5.1