Rocket.Chat · Report #3827674
Authentication Bypass via XML Signature Wrapping in SAML SSO
Validstatus
criticalseverity
39upvotes
27 Jul 2026disclosed
Summary
Rocket.Chat's SAML SSO verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.