← Vulnerability feed

Vulnerability record · CVE-2026-28514 · published 6 March 2026

CVE-2026-28514: Rocket.chat improper authentication vulnerability

RRocket.Chat · Rocket.Chat

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0.

9.3 CVSS 4.0 Critical EPSS 0.73% · top 47.7% CWE-287 · Improper authentication
9.3CVSS 4.0 base score
0.73%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07 Patch
https://github.com/RocketChat/Rocket.Chat/pull/37143 Issue TrackingPatch
https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf MitigationVendor Advisory

Track CVE-2026-28514 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-58066Rocket.chat improper authentication vulnerabilityRocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind t…EPSS 0.38%9.8CVE-2026-29198Rocket.chat sql injection vulnerabilityIn Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover o…EPSS 0.56%9.8CVE-2023-28316Rocket.chat vulnerabilityA security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidate…EPSS 0.72%9.8CVE-2022-44567Rocket.chat os command injection vulnerabilityA command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChat…EPSS 1.7%9.8CVE-2021-22910Rocket.chat vulnerabilityA sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result i…EPSS 2.3%9.8CVE-2021-22911Rocket.Chat improper input sanitization allows unauthenticated NoSQL injectionRocket.Chat server versions 3.11, 3.12 and 3.13 fail to properly sanitize input, allowing unauthenticated NoSQL injection. The flaw can escalate to r…EPSS 95%analysed9.8CVE-2020-29594Rocket.chat vulnerabilityRocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.EPSS 1.6%9.8CVE-2017-1000493Rocket.chat injection vulnerabilityRocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeoverEPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2026-28514), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.