CVE-2026-46423: Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty

Synopsis

This is an authentication bypass in Rocket.Chat's SAML service provider implementation. The vulnerability is reachable over the network with no authentication required: when the IdP certificate field is left empty (its default state), the signature verification routine exits early and accepts any SAML assertion, including ones crafted by an attacker. Successful exploitation lets an attacker authenticate as any user, including administrators, without valid credentials. No fix versions have been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The SAML login endpoint is publicly reachable over the network, so an attacker must be able to send HTTP requests to the Rocket.Chat instance.

• AuthenticationNot required

  No credentials or prior session are needed; the attack targets the pre-authentication SAML login flow.

• Victim interactionNot required

  The attacker submits a crafted SAML assertion directly to the endpoint with no action required from any legitimate user.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: crafting a valid-looking unsigned SAML assertion requires no race condition, memory layout knowledge, or environmental prerequisite.

Blast Radius

• Attacker authenticates as any arbitrary Rocket.Chat user, including workspace administrators, by supplying a self-crafted SAML assertion.
• Full read access to all messages, direct messages, private channels, and file attachments stored in the workspace.
• Full write access to workspace content, user account settings, and administrative configuration, including installed integrations and webhooks.
• Service availability is partially degraded (low impact per CVSS VA:L), for example through disruptive administrative actions performed under the hijacked session.