Authentication Bypass by Capture-replay in Rocket.Chat - CVE-2026-55759
Published: November 9, 2026
Vulnerability identifier: #VU163159
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55759
CWE-ID: CWE-294
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to authenticate as another user on Rocket.Chat instances using Apple Sign-In.
The vulnerability exists due to missing JWT claims validation in the Apple Sign-In handler when processing signed identity tokens, including expired tokens and tokens intended for other applications. An unauthenticated remote attacker can replay an obtained Apple identity token belonging to the target user to gain account access without a replay expiration limit.
Affected software
Rocket.Chat
How to mitigate CVE-2026-55759
Install security update from vendor's website.
Rocket.Chat - addressed in versions 7.10.13, 8.0.7, 8.1.6, 8.2.6, 8.3.6, 8.4.4, 8.5.1