An unauthenticated attacker can supply a MongoDB query operator as the credentialToken in the CAS login request. The server forwards this value directly into a findOne query against the credential_tokens collection, with no runtime type validation. Because the operator matches the first unexpired document, the CAS ticket check is bypassed and the attack succeeds. When a legitimate CAS or SAML login is already in progress, the attacker’s next DDP login request reuses the same injected operator, receives a full Meteor authentication token tied to the victim, and can immediately use that token on all REST and DDP services. If the victim is an administrator, the attacker can install malicious Apps‑Engine applications, fully compromising the instance. This is a NoSQL injection that allows session hijack and potential escalation.

Rocket.Chat, version 8.4.1 and earlier, 8.3.3 and earlier, 8.2.3 and earlier, 8.1.4 and earlier, 8.0.5 and earlier, 7.13.7 and earlier, 7.10.11 and earlier.

The CVSS score of 9.1 reflects a high severity level. Exploitation requires no authentication and only the ability to send a DDP request with a malformed credentialToken; the attack can proceed over the network or any interface that accepts the CAS login handler. EPSS is not available, but the lack of a KEV listing does not reduce the urgency because the flaw exposes critical authentication controls and can be used to compromise administrative accounts.