CVE-2026-45688: Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack

Synopsis

A pre-authentication NoSQL injection vulnerability exists in Rocket.Chat's CAS login handler. An unauthenticated attacker reachable over the network can substitute a MongoDB query operator for the expected CAS ticket string, bypassing the credential check entirely and hijacking an in-flight CAS or SAML session to obtain a valid auth token bound to the victim user. Successful exploitation gives the attacker full read and write access to the Rocket.Chat instance as the victim, and if the victim holds administrator privileges, this extends to complete instance compromise via Apps-Engine. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Rocket.Chat DDP or HTTP endpoint over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or credentials are required; the injection occurs in the unauthenticated CAS login handler before any session is established.

• Victim interactionNot required

  The attacker does not need the victim to click anything; the only dependency is that a legitimate CAS or SAML login flow is in flight at the time of the attack.

• Attack complexityDetail

  The exploit is reliable and condition-free from the attacker's side; the only environmental factor is the timing window created by a concurrent legitimate SSO login, which the attacker can observe or retry.

Blast Radius

• Reads and exfiltrates all messages, files, and channel content accessible to the hijacked user account.
• Writes messages, modifies channel settings, and alters user data on the full REST and DDP API surface as the victim.
• If the hijacked account is an administrator, installs a malicious Rocket.Chat App via Apps-Engine, achieving arbitrary server-side code execution and full instance compromise.
• Extracts stored session tokens and credentials for other users visible to the hijacked account, enabling lateral movement to additional accounts.