CVE-2026-28514 Details
Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0.
A critical authentication bypass vulnerability has been identified in Rocket.Chat's account service, specifically within the ddp-streamer microservice. This vulnerability allows an attacker to log in as any user with a password, using any arbitrary password. The issue arises from a missing await keyword in the asynchronous password validation function, causing a Promise (which is always truthy) to be evaluated instead of the actual validation result. This flaw could lead to account takeover for any user with a known or guessable username. The vulnerability is present in Rocket.Chat versions prior to 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0.
Update to Rocket.Chat versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, or 8.0.0. After updating, ensure that the password validation function is correctly awaited to prevent similar vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07 | [email protected] | Patch |
| https://github.com/RocketChat/Rocket.Chat/pull/37143 | [email protected] | Issue TrackingPatch |
| https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rocket.chat rocket.chat | < 7.8.6 >= 7.9.0, < 7.9.8 >= 7.10.0, < 7.10.7 >= 7.11.0, < 7.11.4 >= 7.12.0, < 7.12.4 >= 7.13.0, < 7.13.3 8.0.0 rc0 8.0.0 rc1 8.0.0 rc2 8.0.0 rc3 8.0.0 rc4 8.0.0 rc5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |