Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-01 | 1 | Patch1 |
| 2026-09-04 | 1 | General1 |
CVE-2026-58066: https://Rocket.Chat SAML SSO Authentication Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04wJx4L0
Post summary
The provided text references CVE-2026-58066 (a SAML SSO authentication bypass) via a link, but offers no PoC, exploit, active attack evidence, patches, or detailed technical information.
CVE-2026-58066 - Critical authentication bypass in Rocket Chat SAML SSO. CVSS 9.8. Upgrade to patched versions immediately. #CVE #RocketChat #infosec #devsecops #developer #cvealert #cybersecurity #developers #linux #git #github #gitlab #redteam #blueteam #linux https://www.valtersit.com/cve/CVE-2026-58066/
Post summary
The tweet highlights a critical authentication bypass CVE (CVE-2026-58066) in Rocket Chat SAML SSO and urges immediate patching.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | rocket.chat | rocket.chat | - | - | - |