CVE-2026-55759

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss is accepted regardless of aud, exp, nbf, or nonce. An attacker who obtains a target user's Apple identity token (from server logs, an intercepted sign-in flow, or another application sharing the same Apple developer team) can replay it to authenticate as that user, with no expiration on the replay window. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-c75c-5hc7-j4vp

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Rocket.Chat es una plataforma de comunicaciones de código abierto, segura y totalmente personalizable. Antes de 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7 y 7.10.13, el gestor de inicio de sesión con Apple de Rocket.Chat verifica las firmas JWT pero omite la validación de las claims. Cualquier JWT firmado por Apple con un ’iss’ no vacío es aceptado independientemente de ’aud’, ’exp’, ’nbf’ o ’nonce’. Un atacante que obtiene el token de identidad de Apple de un usuario objetivo (de los registros del servidor, un flujo de inicio de sesión interceptado o otra aplicación que comparte el mismo equipo de desarrolladores de Apple) puede reproducirlo para autenticarse como ese usuario, sin caducidad en la ventana de reproducción. Esta vulnerabilidad está corregida en 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7 y 7.10.13.

Information

Published : 2026-06-24 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-55759

Mitre link : CVE-2026-55759

CVE.ORG link : CVE-2026-55759

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2026-55759", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55759", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": ">= 8.5.0-rc.0, < 8.5.1"}, {"status": "affected", "version": ">= 8.4.0-rc.0, < 8.4.4"}, {"status": "affected", "version": ">= 8.3.0-rc.0, < 8.3.6"}, {"status": "affected", "version": ">= 8.2.0-rc.0, < 8.2.6"}, {"status": "affected", "version": ">= 8.1.0-rc.0, < 8.1.6"}, {"status": "affected", "version": ">= 7.11.0-rc.0, < 8.0.7"}, {"status": "affected", "version": "< 7.10.13"}]}]}], "published": "2026-06-24T22:16:49.527", "references": [{"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-c75c-5hc7-j4vp", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss is accepted regardless of aud, exp, nbf, or nonce. An attacker who obtains a target user's Apple identity token (from server logs, an intercepted sign-in flow, or another application sharing the same Apple developer team) can replay it to authenticate as that user, with no expiration on the replay window. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13."}, {"lang": "es", "value": "Rocket.Chat es una plataforma de comunicaciones de c\u00f3digo abierto, segura y totalmente personalizable. Antes de 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7 y 7.10.13, el gestor de inicio de sesi\u00f3n con Apple de Rocket.Chat verifica las firmas JWT pero omite la validaci\u00f3n de las claims. Cualquier JWT firmado por Apple con un \u2019iss\u2019 no vac\u00edo es aceptado independientemente de \u2019aud\u2019, \u2019exp\u2019, \u2019nbf\u2019 o \u2019nonce\u2019. Un atacante que obtiene el token de identidad de Apple de un usuario objetivo (de los registros del servidor, un flujo de inicio de sesi\u00f3n interceptado o otra aplicaci\u00f3n que comparte el mismo equipo de desarrolladores de Apple) puede reproducirlo para autenticarse como ese usuario, sin caducidad en la ventana de reproducci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7 y 7.10.13."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}