Complete authentication bypass to admin permissions

Summary

A NoSQL injection vulnerability in Rocket.Chat allows unauthenticated remote attackers to bypass authentication and perform account takeover. By passing a MongoDB operator as the access_token query parameter (e.g., ?access_token[$ne]=null), an attacker can match the first OAuth token in the database without supplying valid credentials. Exploitation requires at least one OAuth token to exist in the database. Affected versions: <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9.