CVE-2026-49277— Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49277
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth access token, and can also mint a fresh access token from an existing refresh token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
不充分的会话过期机制
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| RocketChat | Rocket.Chat | >= 8.5.0-rc.0, < 8.5.0 | - |
II. Public POCs for CVE-2026-49277
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49277
请登录查看更多情报信息。
Other References for CVE-2026-49277 (1)
Same Patch Batch · RocketChat · 2026-06-24 · 12 CVEs total
| CVE-2026-45688 | 9.1 CRITICAL | Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML U |
| CVE-2026-45689 | 9.1 CRITICAL | Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User A |
| CVE-2026-45687 | 8.5 HIGH | Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMess |
| CVE-2026-55762 | 8.1 HIGH | Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat |
| CVE-2026-55759 | 7.4 HIGH | Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audienc |
| CVE-2026-49278 | 6.7 MEDIUM | Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Im |
| CVE-2026-47733 | 4.4 MEDIUM | Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in |
| CVE-2026-45677 | Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS | |
| CVE-2026-45757 | Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login to | |
| CVE-2026-46423 | Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty | |
| CVE-2026-55666 | Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth |
IV. Related Vulnerabilities
Same product: Rocket.Chat
- CVE-2026-55762
Rocket.Chat: Any Authenticated User Can Permanently Deregist - CVE-2026-55759
Rocket.Chat: Apple Sign-In skips JWT claims validation, allo - CVE-2026-55666
Rocket.Chat: Email Parameter Fallback Leads To Account Takeo - CVE-2026-49278
Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Beare - CVE-2026-45757
Rocket.Chat: users.deactivateIdle` deactivates accounts with
Same vendor: RocketChat
- CVE-2026-55762
Rocket.Chat: Any Authenticated User Can Permanently Deregist - CVE-2026-55759
Rocket.Chat: Apple Sign-In skips JWT claims validation, allo - CVE-2026-55666
Rocket.Chat: Email Parameter Fallback Leads To Account Takeo - CVE-2026-49278
Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Beare - CVE-2026-45757
Rocket.Chat: users.deactivateIdle` deactivates accounts with
Same weakness: CWE-613
- CVE-2025-71335
Flowise - Session Invalidation Failure After Password Change - CVE-2026-54479
EVoke Systems EVoke CSMS Insufficient Session Expiration - CVE-2026-9705
Keycloak: keycloak: attacker can re-enable and take over dis - CVE-2026-45757
Rocket.Chat: users.deactivateIdle` deactivates accounts with - CVE-2026-46554
NocoDB: Stale Auth Cache After API Token Deletion
V. Comments for CVE-2026-49277
No comments yet