Rocket.Chat SAML Signature Verification Bypass Vulnerability (CVE-2026-45423)

Vulnerability Overview In Rocket.Chat's SAML Service Provider implementation, signature validation of SAML responses and assertions is silently skipped when the IdP certificate field is empty. The method returns early when is (the default setting), causing the signature validation logic to be bypassed. Scope Affected Versions: - <8.5.0, <8.4.1, <8.3.3, <8.2.3, 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, <8.1.4, <8.0.5, <7.13.7, 8.0.5, 7.13.7, 7.10.11, <7.10.11 Severity: High CVE ID: CVE-2026-45423 Weakness: CWE-347 Credit: romain-despres Remediation 1. Fail Closed in the Signature Verifier: - In , replace the early return with an explicit error when is not provided. 2. Reject Empty Certificates at Provider Configuration: - In (and any helper functions used to construct ), validate that is a non-empty PEM-encoded string. Instead of failing silently, the provider should skip this check and log a warning if the provider fails. 3. Add UI Validation: - Add server-side settings validation to prevent persisting the "Enable" toggle for a SAML provider when the associated field is empty, even if the provider is enabled. The UI should display this as a blocking validation error on the SAML settings page, preventing administrators from reaching a failure state through normal configuration workflows. Defense in Depth 1. Log a startup message at the or level when encounters an enabled provider with an empty , including pointers to the settings that require attention. 2. Add regression tests that feed unsigned assertions with an empty into and assert that the call throws an error. 3. Audit other SAML options where an "empty means skip" semantic might create similar failure branches (e.g., signature key material, assertion decryption key, and trust anchors). 4. Consider making the IdP certificate field a required setting at the schema level, so that the SAML feature cannot be enabled without providing it. Affected Files (lines 243-245) (lines 48, 122-148, 196)

Goal Reached Thanks to every supporter — we hit 100%!

Rocket.Chat SAML Signature Verification Bypass Vulnerability (CVE-2026-45423)

More from this source