SAML Authentication Bypass in Rocket.Chat

CVE-2026-46423

What is CVE-2026-46423?

Rocket.Chat is an open-source communications platform that, before specific versions, allowed an authentication bypass due to a flaw in its SAML service provider implementation. When the IdP certificate field is empty, the system fails to validate the SAML Response and Assertion signatures. This occurs because the verifySignatures routine returns early when no certificate is present. Administrators who enable SAML without providing a certificate inadvertently expose a login endpoint that accepts unsigned or maliciously crafted assertions. This critical flaw poses a significant security risk by allowing unauthorized access if configurations are left at their default settings. Affected versions have been addressed in updates.

References