CVE-2026-55666: Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth

Synopsis

This is an authentication bypass vulnerability in Rocket.Chat's Apple OAuth login handler. The flaw is reachable over the network with no authentication required, because the server-side JWT parser falls back to accepting an attacker-supplied email address when Apple's JWT omits one, allowing an attacker to forge an OAuth token and impersonate any account. Successful exploitation gives the attacker full control of the targeted Rocket.Chat account. No fix versions have been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable OAuth endpoint is exposed over the network, so an attacker must be able to reach the Rocket.Chat server via standard HTTPS.

• AuthenticationNot required

  No credentials or existing session are needed; the attacker interacts with the unauthenticated Apple OAuth login flow directly.

• Victim interactionNot required

  The attacker crafts and submits a forged JWT independently; no action by the target user is necessary.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: forging a JWT without an email field requires no race conditions or special environmental factors.

Blast Radius

• Attacker gains full authenticated access to the targeted Rocket.Chat account, reading all private messages, direct messages, and channel history.
• Attacker can post messages, modify account settings, and exfiltrate any data the compromised account can access, including files and integrations.
• If the targeted account holds admin privileges, the attacker inherits those privileges and can reconfigure the entire Rocket.Chat workspace.