CVE-2026-55759: Rocket.Chat Apple Sign-In JWT Validation Bypass – Authentication Takeover

Technical summary

CVE-2026-55759 is an authentication bypass in Rocket.Chat's Apple Sign-In handler caused by incomplete JWT validation. The handler performs signature verification against Apple's public keys but omits validation of critical JWT claims including iss (issuer), aud (audience), exp (expiration), nbf (not-before), and nonce. An attacker can take any Apple-signed JWT with a non-empty issuer claim and use it to authenticate as the associated user indefinitely. The vulnerability requires network access and knowledge of a valid identity token but no interaction with the target user. This is classified under CWE-287 (improper authentication) and CWE-294 (authentication bypass by capture-replay).

Business impact

An attacker exploiting this vulnerability gains unauthorized access to Rocket.Chat accounts. Because Rocket.Chat is commonly used for team communication, incident response, and sensitive project coordination, account takeover can lead to exposure of confidential conversations, intellectual property theft, lateral movement to connected systems, impersonation of team members, and disruption of critical communications. Organizations using Rocket.Chat with Apple Sign-In are directly impacted. The lack of any replay window expiration means tokens obtained months or years ago remain valid, increasing the window of exposure for historical token leakage incidents.

Affected systems

Rocket.Chat versions prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13 are vulnerable when Apple Sign-In is configured and enabled. The vulnerability is present across multiple maintained release branches (7.10, 8.0, 8.1, 8.2, 8.3, 8.4, and 8.5). Only deployments using Apple Sign-In as an authentication method are affected; deployments relying solely on other authentication providers (email, LDAP, OAuth via other providers) are not impacted.

Exploitability

The vulnerability has moderate-to-high exploitability. An attacker must first obtain a valid Apple identity token, which could come from server logs (if debug logging is enabled), interception of a sign-in flow over unencrypted connections, or from another application that shares the same Apple developer team and leaks tokens. Once a token is obtained, exploitation is trivial: replay it to Rocket.Chat's Apple Sign-In endpoint with no special privileges or user interaction required. The attack is not listed in the CISA Known Exploited Vulnerabilities catalog as of the publication date, but the simplicity of exploitation once a token is acquired means organizations should prioritize remediation.

Remediation

Upgrade Rocket.Chat to a patched version immediately. The fixes are available in 7.10.13 (for the 7.10 branch), 8.0.7, 8.1.6, 8.2.6, 8.3.6, 8.4.4, and 8.5.1 (for newer branches). Organizations unable to upgrade immediately should disable Apple Sign-In as an authentication method if alternative authentication providers are available. If Apple Sign-In must remain active, implement network-level controls to restrict access to Rocket.Chat to trusted networks and monitor authentication logs for suspicious login patterns or impossible travel scenarios.

Patch guidance

Rocket.Chat has released patches across all supported release branches. Identify your current version and upgrade to the earliest patched version in your branch (for example, if running 8.2.x, upgrade to 8.2.6 or later; if running 8.5.x, upgrade to 8.5.1 or later). Test patches in a staging environment before production deployment to ensure compatibility with customizations and integrations. After patching, consider invalidating existing Apple Sign-In sessions and requiring users to re-authenticate using the updated handler.

Detection guidance

Monitor Rocket.Chat authentication logs for successful Apple Sign-In events, paying particular attention to logins from unusual geographic locations, times, or devices associated with a single user account. Enable detailed audit logging if available. Check Rocket.Chat server logs for evidence of token replay attempts or authentication handler errors during the vulnerable period. If you suspect token leakage, review access logs and backups for any unauthorized data access coinciding with suspicious login events. Organizations with centralized SIEM systems should create alerts for multiple failed authentication attempts followed by successful Apple Sign-In from different IP addresses within a short window.

Why prioritize this

This vulnerability merits HIGH priority remediation due to the combination of complete account takeover capability, the broad scope (multiple Rocket.Chat versions), the ease of exploitation once a token is obtained, and the indefinite replay window. Although obtaining a token requires separate access (logs, interception, or another application), the attack surface is larger than a typical authentication flaw and the impact is complete. The availability of patches across all branches removes deployment barriers.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects high impact on confidentiality and integrity (account takeover leads to unauthorized access to communications and data), medium complexity to exploit (attacker must obtain a valid token), and network-based attack vector. The score does not account for the indefinite replay window or the multiple pathways to obtain a token, which increase practical exploitability. The absence of availability impact (reflected in the A:N vector component) is appropriate since this is an authentication bypass, not a denial-of-service or resource exhaustion flaw.

Frequently asked questions