Summary
CVE-2026-45688 is a critical pre-authentication NoSQL injection vulnerability in Rocket.Chat’s CAS login handler, rated 9.1 (Critical) on the CVSS v3.1 scale. An unauthenticated remote attacker can inject MongoDB query operators in place of a CAS credential ticket to hijack the session of any user performing an active SSO login, obtaining a fully valid authentication token for that user’s account. If the hijacked session belongs to an administrator, the attacker can escalate to full server compromise.
Technical details
- Root cause: The CAS login handler passes the client-supplied
options.cas.credentialTokenvalue directly into a MongoDBfindOne({_id: ...})query with no runtime type validation. TypeScript’s string type annotation is erased at runtime, so an attacker can substitute a MongoDB query operator (e.g.,{"$gt": ""}or{"$ne": null}) for the expected opaque ticket string. - Trigger conditions: CAS or SAML SSO must be configured on the target instance, and a legitimate SSO login must be in progress. The credential token has a 60-second validity window during which the attack can be executed. Notably, the CAS handler is registered at server startup regardless of whether CAS is explicitly enabled, and because both CAS and SAML write to the same
credential_tokenscollection, SAML-only deployments are also reachable via this injection path. - Attack vector: Unauthenticated network request over the DDP WebSocket endpoint (
/websocket). No credentials, accounts, or user interaction required. - Impact: The injected operator matches the first unexpired document in the
credential_tokenscollection. The attacker receives a full Meteor authentication token (userId+token) bound to the victim user, immediately usable against the complete REST and DDP API surface. If the victim is an administrator, the attacker can install arbitrary Apps-Engine applications, achieving full server-side code execution.
Affected software
- Rocket.Chat versions prior to 7.10.11
- Rocket.Chat 7.11.x – 7.12.x (all versions prior to 7.13.7)
- Rocket.Chat 8.0.x prior to 8.0.5
- Rocket.Chat 8.1.x prior to 8.1.4
- Rocket.Chat 8.2.x prior to 8.2.3
- Rocket.Chat 8.3.x prior to 8.3.3
- Rocket.Chat 8.4.x prior to 8.4.1
- Rocket.Chat 8.5.x prior to 8.5.0
Severity
CVSS v3.1 Base Score: 9.1 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate action — patch: Upgrade to one of the following fixed releases depending on your current branch:
- 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11
- If immediate patching is not possible:
- Temporarily disable CAS and SAML SSO authentication on your instance to eliminate the credential-token race window exploited by this attack.
- Restrict network access to the Rocket.Chat DDP WebSocket endpoint (
/websocket) to trusted IP ranges only. - Monitor DDP authentication logs for anomalous login attempts, particularly those occurring in rapid succession during or immediately after SSO login events.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.