Open Redirect Vulnerability in Rocket.Chat by Rocket.Chat
CVE-2026-22560

5.3MEDIUM

Key Information:

Vendor

Rocket.chat

Status
Rocket.chat
Vendor
CVE Published:
10 April 2026

What is CVE-2026-22560?

An open redirect vulnerability in Rocket.Chat prior to version 8.4.0 enables unauthorized users to redirect legitimate requests to arbitrary external URLs by manipulating parameters within the SAML authentication endpoint. This flaw could lead to phishing attacks and data exposure by allowing malicious actors to deceive users into revealing sensitive information.

Affected Version(s)

Rocket.Chat 8.4.0

References

https://hackerone.com/reports/3418031
https://github.com/RocketChat/Rocket.Chat/pull/38994

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.