The vulnerability lies in Rocket.Chat’s handling of SAML SSO in several releases. While XML signatures were verified, the implementation failed to bind the verified signature to the samlp:Response or saml:Assertion. Consequently an attacker can craft a wrapper document that includes forged identity attributes and a valid Signature from the trusted IdP certificate, enabling login as any user. The bypass permits full authentication to the system with the privileges of the chosen account, leading to unauthorized access and potential data compromise.

Rocket.Chat SaaS or on‑prem installations that use SAML SSO and run any of the following releases are affected: 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14. Any deployment in these versions can be exploited. Versions newer than the ones listed have presumably fixed the issue (inferred from the lack of disclosure).

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1%, suggesting a low current exploitation probability, and the flaw is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, is the SAML authentication endpoint, where an adversary can pose as an IdP, send a signed response that the server accepts without binding the signature to the assertion, and thereby forge user claims. While no official exploitation proof is documented, the missing binding step creates a clear path to account takeover, making the issue credible particularly for environments where SAML SSO is enabled for privileged or sensitive accounts.