CVE-2026-58066

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.7.0 Rocket.Chat versions prior to 8.6.1 Rocket.Chat versions prior to 8.5.2 Rocket.Chat versions prior to 8.4.5 Rocket.Chat versions prior to 8.3.7 Rocket.Chat versions prior to 8.2.7 Rocket.Chat versions prior to 8.1.7 Rocket.Chat versions prior to 8.0.8 Rocket.Chat versions prior to 7.10.14

Description The SAML SSO implementation verifies XML signatures but fails to bind the validated signature to the samlp:Response or saml:Assertion. This allows an attacker to use a technique called XML Signature Wrapping, where a wrapped document containing forged identity attributes is submitted alongside a valid signature from a trusted Identity Provider (IdP) certificate to gain unauthorized access as an arbitrary user.

Recommendations Update to version 8.7.0 or later. Update to version 8.6.1 or later. Update to version 8.5.2 or later. Update to version 8.4.5 or later. Update to version 8.3.7 or later. Update to version 8.2.7 or later. Update to version 8.1.7 or later. Update to version 8.0.8 or later. Update to version 7.10.14 or later.