CVE-2026-55666

Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth

Published Jun 24, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an email parameter. If the JWT does not contain an email address, the application falls back to accepting an arbitrary email value supplied directly in the request. Attackers are able to forge Apple JWTs that do not contain an email address and leverage this vulnerability to carry out account takeover attacks. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

Analysis

Technical impact

The missing email check in Apple OAuth causes attackers to supply forged Apple JWTs without an email and set an arbitrary email in the request, allowing them to impersonate any user and take over their account; this is a credential reuse or account takeover vulnerability, reflected in CWE‑287 and CWE‑288.

Affected Systems

Rocket.Chat servers running any release prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, or 7.10.13 are affected; older versions of these releases are also vulnerable.

Risk and Exploitability

The CVSS base score of 9.3 indicates critical severity, and while EPSS data is not available, the absence of KEV listing does not lower the likelihood of exploitation; the vulnerability can be exploited remotely by forging an Apple OAuth JWT and supplying any email address during the login request, making it a straightforward account takeover scenario.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

RocketChat

Rocket.Chat

affected

Version	Status	Constraints
`>= 8.5.0-rc.0, < 8.5.1`	affected	—
`>= 8.4.0-rc.0, < 8.4.4`	affected	—
`>= 8.3.0-rc.0, < 8.3.6`	affected	—
`>= 8.2.0-rc.0, < 8.2.6`	affected	—
`>= 8.1.0-rc.0, < 8.1.6`	affected	—
`>= 7.11.0-rc.0, < 8.0.7`	affected	—
`< 7.10.13`	affected	—

No data.

Vendor Product Versions

Rocketchat

Rocket.chat

Version	Status	Scheme	Platform
`[8.5.0-rc.0,8.5.1)`	affected	semver	—
`[8.4.0-rc.0,8.4.4)`	affected	semver	—
`[8.3.0-rc.0,8.3.6)`	affected	semver	—
`[8.2.0-rc.0,8.2.6)`	affected	semver	—
`[8.1.0-rc.0,8.1.6)`	affected	semver	—
`[7.11.0-rc.0,8.0.7)`	affected	semver	—
`[0,7.10.13)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Rocket.Chat to the latest patched version (8.5.1 or later) to eliminate the fallback email vulnerability.
Restart the Rocket.Chat application to ensure the new code is loaded.
Verify that Apple OAuth login only accepts JWTs containing the email claim and reject any login attempts lacking it; monitor authentication logs for suspicious patterns.

Generated by OpenCVE AI on June 25, 2026 at 00:42 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.406% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-wx3c-76rf-wpwf

History

Jun 29, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 25, 2026 8:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rocketchat Rocketchat rocket.chat
Vendors & Products		Rocketchat Rocketchat rocket.chat

Jun 24, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an email parameter. If the JWT does not contain an email address, the application falls back to accepting an arbitrary email value supplied directly in the request. Attackers are able to forge Apple JWTs that do not contain an email address and leverage this vulnerability to carry out account takeover attacks. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.
Title		Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth
Weaknesses		CWE-287 CWE-288
References		https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-wx3c-76rf-wpwf
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`