Auth bypass in Rocketchat Rocket.chat
CVE-2026-55666
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by…
Vulnerability class: Broken Authentication
Affected products
- Rocketchat Rocket.chat — versions >= 8.5.0-rc.0, < 8.5.1, >= 8.4.0-rc.0, < 8.4.4, >= 8.3.0-rc.0, < 8.3.6
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)