CVE-2026-46423

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML service provider implementation silently skips both SAML Response and Assertion signature validation when the configured IdP certificate field is empty. The verifySignatures routine performs an early return when serviceProviderOptions.cert is falsy, which is the default state of the setting. Because provider registration only gates on the SAML "enabled" toggle and not on the presence of a certificate, an administrator who enables SAML without pasting an IdP certificate obtains a fully wired, publicly reachable SAML login endpoint that accepts unsigned or attacker-supplied assertions. This is a default-configuration authentication-bypass class: the fail-open branch is reached with no misconfiguration beyond leaving a field at its shipped default. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

• CWE-347

• https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-rgg7-qvp9-wvx7

Published

Jun 24, 2026

Last Modified

Jun 26, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46415The Caddy Defender plugin is a middleware for Caddy that all…8.2
• CVE-2026-46416Microsoft UFO open-source framework for intelligent automati…6.3
• CVE-2026-46417Angular is a development platform for building mobile and de…6.1
• CVE-2026-46419Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0…7.5
• CVE-2026-46420setup-php is a GitHub action to set up PHP with extensions, …5.6
• CVE-2026-46421The SAP Cloud Application Programming Model is a tool for bu…9.3
• CVE-2026-46424Budibase is an open-source low-code platform. Prior to 3.38.…4.2
• CVE-2026-46425Budibase is an open-source low-code platform. Prior to 3.38.…9.9
• CVE-2026-46426Budibase is an open-source low-code platform. Prior to 3.38.…7.6
• CVE-2026-46427Budibase is an open-source low-code platform. Prior to 3.38.…7.7
• CVE-2026-46428lettre is a a mailer library for Rust. Starting in version 0…9.1
• CVE-2026-4643Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to…3.5