CVE-2026-46423 Details

A vulnerability in Rocket.Chat's SAML service provider implementation allows for authentication bypass when the IdP certificate field is left empty. In versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, the SAML Response and Assertion signature validations are silently skipped if the certificate field is not populated. This oversight occurs because the default setting for the certificate is an empty string, and the provider registration process does not require a certificate to be present. As a result, an administrator who enables SAML without providing a certificate exposes a publicly accessible SAML login endpoint that accepts unsigned or manipulated assertions. This vulnerability allows remote attackers to impersonate users, including administrators, by exploiting the SAML authentication flow.

To address this vulnerability, the SAML signature verifier should be modified to reject empty certificate fields and throw an error instead of returning early. Additionally, a server-side settings validator should be implemented to prevent the SAML provider from being enabled without a valid certificate. This validation should be reflected in the settings UI to alert administrators of the misconfiguration.