Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authentication vulnerabilities exist in Rocket.Chat's enterprise DDP Streamer service. The Account.login method exposed through the DDP Streamer does not enforce Two-Factor Authentication (2FA) or validate user account status (deactivated users can still login), despite these checks being mandatory in the standard Meteor login flow. This issue has been patched in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-30831 http://Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, authenti… https://www.cve.org/CVERecord?id=CVE-2026-30831
Post summary
The post announces CVE-2026-30831 affecting Rocket.Chat before certain releases, but provides no further technical details or evidence of exploitation.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30831 - http://Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer Intel Report: https://ift.tt/qBGgZr7
Post summary
The post announces CVE-2026-30831 with a description of a 2FA bypass in Rocket.Chat via EE ddp-streamer, but provides no PoC, exploit code, patch, or evidence of active exploitation.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | rocket.chat | rocket.chat | - | - | - |
| App | rocket.chat | rocket.chat | 8.2.0 | - | - |
| App | rocket.chat | rocket.chat | 8.2.0 | - | - |
| App | rocket.chat | rocket.chat | 8.2.0 | - | - |