TI-2026-33431 Aliases CVE-2026-45689

Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO

HIGH 74CWE-943Published 2026-06-24 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant parameters are strings before forwarding them to findOne({...}) against the oauth_apps and oauth_access_tokens collections, so an attacker substitutes {"$ne": null} for client_id, client_secret, and refresh_token and receives a freshly minted {access_token, refresh_token} pair bound to whichever user's refresh token Mongo returned first. The resulting access token is a first-class bearer credential against the full /api/v1/* surface as that user. By iterating with $nin / $regex operators the attacker walks the entire oauth_access_tokens collection, collecting one fresh access token per user per request. If any matched token belongs to an admin, the stolen bearer gives full admin API access (including Apps-Engine app installation, i.e. server-side code execution). No account, credentials, userId, or prior interaction with the instance are required. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00526 44th percentileScored 2026-11-07

Fix Fixed Rocket.Chat (RocketChat): 8.5.0, 8.4.1, 8.3.3 +5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
RocketChat	Rocket.Chat	8.5.0-rc.0 to before 8.5.0; 8.4.0-rc.0 to before 8.4.1; 8.3.0-rc.0 to before 8.3.3; 8.2.0-rc.0 to before 8.2.3; 8.1.0-rc.0 to before 8.1.4; 8.0.0-rc.0 to before 8.0.5; 7.11.0-rc.0 to before 7.13.7; before 7.10.11	8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, 7.10.11	Patch available	CNA

Rocket.Chat VendorRocketChat Affected 8.5.0-rc.0 to before 8.5.0; 8.4.0-rc.0 to before 8.4.1; 8.3.0-rc.0 to before 8.3.3; 8.2.0-rc.0 to before 8.2.3; 8.1.0-rc.0 to before 8.1.4; 8.0.0-rc.0 to before 8.0.5; 7.11.0-rc.0 to before 7.13.7; before 7.10.11 Fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, 7.10.11 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:rocket.chat:rocket.chat::::::::	—	—	Rocket.Chat

cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:* Versions — — ·Rocket.Chat

Remediation

Fix · CNA Rocket.Chat (RocketChat) Fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, 7.10.11

Timeline

2026-10-02 Threatist record created from CVE-2026-45689
2026-11-03 CISA SSVC decision points changed

References

Other 1

https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-8p25-fm45-pjrw

TI-2026-33430 Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack CVSS 3.1CRITICAL 9.1
TI-2026-18910 Rocket.Chat Unauthorized Access to OAuth App Details CVSS 3.1HIGH 7.7
TI-2026-35234 Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images CVSS 3.1MEDIUM 4.4
TI-2026-22776 Rocket.Chat: Users can login with any password via the EE ddp-streamer-service CVSS 4.0CRITICAL 9.3
TI-2026-40188 Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth CVSS 4.0CRITICAL 9.3
TI-2026-34135 Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty CVSS 4.0CRITICAL 9.3

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences