Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-55666

Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth

Critical9.3EPSS 0.41%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an email parameter. If the JWT does not contain an email address, the application falls back to accepting an arbitrary email value supplied directly in the request. Attackers are able to forge Apple JWTs that do not contain an email address and leverage this vulnerability to carry out account takeover attacks. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

Scores

CVSS scores of CVE-2026-55666, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Deferred4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.41% · top 65% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

Affected products

  • RocketChat · Rocket.Chat

    • affected >= 8.5.0-rc.0, < 8.5.1
    • affected >= 8.4.0-rc.0, < 8.4.4
    • affected >= 8.3.0-rc.0, < 8.3.6
    • affected >= 8.2.0-rc.0, < 8.2.6
    • affected >= 8.1.0-rc.0, < 8.1.6
    • affected >= 7.11.0-rc.0, < 8.0.7
    • affected < 7.10.13

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-55666 badge
[![CVE-2026-55666](https://trackcve.app/badge/CVE-2026-55666.svg)](https://trackcve.app/cve/CVE-2026-55666)

Record last updated .