The vulnerability is a NoSQL injection in Rocket.Chat’s OAuth2 token endpoint (/oauth/token) in versions before 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. An unauthenticated network attacker can send a single POST request that includes MongoDB query operators such as {"$ne": null} for the grant parameters client_id, client_secret, and refresh_token. Because Rocket.Chat does not validate that these parameters are strings, it forwards them to a findOne query against the oauth_apps and oauth_access_tokens collections. The server therefore returns a newly minted access_token and refresh_token pair bound to the first matching user found in the database. This bearer token grants full access to the /api/v1/* surface for that user. By iterating with $nin or $regex operators the attacker can walk the entire oauth_access_tokens collection, collecting one fresh token per user per request. If an administrator’s token is obtained, the adversary gains full admin API capabilities, including the ability to install Apps-Engine applications and achieve server‑side code execution. No prior account or credentials are required. The flaw is identified as a NoSQL injection, CWE‑943.

Rocket.Chat software versions earlier than 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11 are affected. Updating to any of the patched releases listed above removes the vulnerability.

The CVSS score of 9.1 indicates critical severity. No EPSS score is available, and the vulnerability is not yet listed in the CISA KEV catalog. The attack can be carried out over the network by any remote actor without authentication, making exploitation highly likely if the software remains unpatched.