CVE-2026-58066
Last modified
CVE-2026-58066 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Rocket.Chat | Rocket.Chat | < 8.7.0; < 8.6.1; < 8.5.2; < 8.4.5; < 8.3.7; < 8.2.7; < 8.1.7; < 8.0.8; < 7.10.14 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-58066?
How severe is CVE-2026-58066?
How do I fix CVE-2026-58066?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-5806A security vulnerability has been detected in code-projects …3.5
- CVE-2026-58060In Bouncy Castle for Java before 1.85, HSS public-key level …8.7
- CVE-2026-58061In Bouncy Castle for Java before 1.85, CCM-family modes writ…8.7
- CVE-2026-58062In Bouncy Castle for Java before 1.85, Stapled OCSP response…9.3
- CVE-2026-58063In Bouncy Castle for Java before 1.85, BCFKS keystore load h…5.3
- CVE-2026-58065The Apache Airflow Git provider runs its git-over-SSH operat…8.1
- CVE-2026-58067A vulnerability in Veeam Service Provider Console allowing a…8.7
- CVE-2026-5807Vault is vulnerable to a denial-of-service condition where a…7.5
- CVE-2026-58071A vulnerability in Veeam Service Provider Console allowing a…8.2
- CVE-2026-58072A vulnerability in Veeam Service Provider Console allowing a…9
- CVE-2026-58073A vulnerability in Veeam Service Provider Console allowing a…9.5
- CVE-2026-58074A vulnerability allowing a high-privileged user to execute a…8.6
Are you affected by CVE-2026-58066?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST