Rocket.Chat’s SAML integration fails to check the signature of inbound LogoutRequest messages. An attacker who knows the target user’s SAML NameID—a value that most identity providers expose as the user’s email address—can create an unsigned LogoutRequest that looks legitimate and send it to Rocket.Chat’s logout endpoint. The server treats this request as valid and immediately ends the user’s session. Because the exploit requires no authentication or user interaction, an attacker can repeatedly send such requests, effectively performing a denial‑of‑service against SAML‑authenticated users.

The affected product is RocketChat:Rocket.Chat. All releases prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11 must be upgraded to versions that include the fix. The vulnerability has been patched in those releases, rendering them secure against this specific logout request forgery.

The CVSS score of 8.7 reflects a high likelihood of successful exploitation with severe impact. Because the attacker only needs to know a target user’s SAML NameID—frequently exposed as the user’s email address by major identity providers—a wide range of adversaries can craft and replay unsigned LogoutRequests. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, but the ease of exploitation and the potential to repeatedly deny service to many accounts indicate a significant operational risk.