A missing await keyword in Rocket.Chat’s ddp-streamer microservice causes the asynchronous password validator to return a Promise object that is always truthy. As a result, any submitted password is accepted for any username that has a password set, allowing an attacker to authenticate as that user. Because the bypass removes the need for a correct password, the vulnerability can lead to full account takeover, compromising confidential user data and sensitive communications. The flaw is a classic example of improper authentication, mapped to CWE‑287.

All Rocket.Chat instances running a version earlier than the patched releases 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3 or 8.0.0 are affected. The issue resides specifically in the Enterprise Edition ddp-streamer microservice.

The CVSS score is 9.3, classifying the flaw as critical, while the EPSS score is less than 1%, indicating a low current probability of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector is remote via the exposed authentication endpoint of the ddp-streamer service; based on the description, it is inferred that an attacker can perform the bypass by supplying any password after knowing a valid username.