The vulnerability lies in Rocket.Chat’s Enterprise DDP Streamer service. The Account.login method exposed through this service does not enforce two‑factor authentication and fails to check whether an account has been deactivated. An attacker can use this method to authenticate as any user without providing the second factor and can also log in with accounts that are marked as deactivated, thereby bypassing standard security controls. This allows unauthorised access to the application and potentially to any data within the system.

Affected products include Rocket.Chat Enterprise editions running Rocket.Chat versions 7.10.7 and earlier, 7.11.4 and earlier, 7.12.4 and earlier, 7.13.3 and earlier, 8.0.1 and earlier, 8.1.0 and earlier, and 8.2.0 before the update. The issue also affects release candidate builds 8.2.0‑rc0 to rc2. Security updates released in the corresponding minor versions (7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0) contain the fix.

The vulnerability has a CVSS score of 8, classifying it as high severity. The EPSS score is less than 1%, indicating a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The attack can be carried out remotely by anyone who can reach the Enterprise DDP Streamer endpoint, with no special authentication required. An attacker could simply issue a valid Account.login request over the DDP stream to gain access to any account without the second factor or to re‑activate a deactivated account.