Open Redirect Vulnerability in Rocket.Chat by Rocket.Chat
CVE-2026-22560

Currently unrated

Key Information:

Vendor: Rocket.chat
Status: Rocket.chat
Vendor: CVE Published:; 10 April 2026

🔔 Create Rocket.chat Vulnerability Alert

What is CVE-2026-22560?

An open redirect vulnerability in Rocket.Chat prior to version 8.4.0 enables unauthorized users to redirect legitimate requests to arbitrary external URLs by manipulating parameters within the SAML authentication endpoint. This flaw could lead to phishing attacks and data exposure by allowing malicious actors to deceive users into revealing sensitive information.

Affected Version(s)

Rocket.Chat 8.4.0

References

https://hackerone.com/reports/3418031

https://github.com/RocketChat/Rocket.Chat/pull/38994

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 10, 2026
Vulnerability Reserved
Jan 7, 2026

CVE-2026-22560 Data

JSON