Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-45677

Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS

High8.7EPSS 0.68%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML integration does not verify the signature on inbound LogoutRequest messages. An unauthenticated remote attacker who knows a target user's SAML NameID - which major identity providers (Okta, Google Workspace, Microsoft Entra ID, JumpCloud) expose as the user's email address - can craft a valid-looking unsigned LogoutRequest and submit it to the SP logout endpoint. The server processes it as legitimate, immediately destroying the victim's session. Because the attack requires no authentication and no interaction from the victim, it can be repeated in a loop against individual users or scripted across many accounts, effectively rendering the Rocket.Chat instance unusable for SAML-authenticated users. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

Scores

CVSS scores of CVE-2026-45677, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)4.0High8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
NVDNVD · Deferred4.0High8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.68% · top 47% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

Affected products

  • RocketChat · Rocket.Chat

    • affected >= 8.5.0-rc.0, < 8.5.0
    • affected >= 8.4.0-rc.0, < 8.4.1
    • affected >= 8.3.0-rc.0, < 8.3.3
    • affected >= 8.2.0-rc.0, < 8.2.3
    • affected >= 8.1.0-rc.0, < 8.1.4
    • affected >= 8.0.0-rc.0, < 8.0.5
    • affected >= 7.11.0-rc.0, < 7.13.7
    • affected < 7.10.11

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-45677 badge
[![CVE-2026-45677](https://trackcve.app/badge/CVE-2026-45677.svg)](https://trackcve.app/cve/CVE-2026-45677)

Record last updated .