Rocket.Chat’s SAML service provider implementation silently omits verification of both SAML Response and Assertion signatures whenever the IdP certificate field is left empty. The verification routine returns early when the certificate setting is falsy, which is the default configuration. Because only the SAML enabled toggle is checked during provider registration, an administrator who turns on SAML without supplying a certificate creates a publicly reachable login endpoint that accepts unsigned or attacker‑supplied assertions, effectively bypassing authentication. The flaw is classified as CWE‑347.

The issue impacts all Rocket.Chat installations running versions earlier than 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11. These versions allow the SAML service provider to be enabled without an IdP certificate, exposing the vulnerability. The affected product is Rocket.Chat, an open‑source communications platform.

The CVSS base score is 9.3, indicating critical severity. EPSS data is not available. The flaw is exploitable in the default configuration; merely enabling SAML without configuring an IdP certificate is sufficient to create a publicly exposed endpoint that accepts unsigned assertions. Because the vulnerability requires no misconfiguration beyond the shipped defaults, the threat is substantial. The issue is not listed in the CISA KEV catalog, but its high CVSS score and ease of exploitation pose a significant risk to organizations relying on SAML authentication in Rocket.Chat.